Terjemahan disediakan oleh mesin penerjemah. Jika konten terjemahan yang diberikan bertentangan dengan versi bahasa Inggris aslinya, utamakan versi bahasa Inggris.

# Luncurkan landing zone menggunakan CloudFormation
<a name="lz-apis-cfn"></a>

Anda dapat mengonfigurasi dan meluncurkan landing zone dengan CloudFormation baik melalui CloudFormation konsol, atau melalui AWS CLI. Bagian ini memberikan instruksi dan contoh untuk meluncurkan landing zone menggunakan APIs through CloudFormation. 

**Topics**
+ [Prasyarat untuk meluncurkan landing zone menggunakan CloudFormation](lz-apis-cfn-setup.md)
+ [Buat landing zone baru menggunakan CloudFormation](lz-apis-cfn-launch.md)
+ [Mengelola landing zone yang ada menggunakan CloudFormation](lz-apis-cfn-launch-existing.md)

# Prasyarat untuk meluncurkan landing zone menggunakan CloudFormation
<a name="lz-apis-cfn-setup"></a>

1. Dari AWS CLI, gunakan AWS Organizations `CreateOrganization` API untuk membuat organisasi dan mengaktifkan semua fitur. 

   Untuk instruksi yang lebih rinci, tinjau[Langkah 1: Konfigurasikan landing zone Anda](lz-api-prereques.md). 

1. Dari CloudFormation konsol atau menggunakan AWS CLI, gunakan CloudFormation templat yang membuat sumber daya berikut di akun manajemen: 
   + Akun Log Archive (kadang-kadang disebut akun “Logging”) 
   + Akun audit (kadang-kadang disebut akun “Keamanan”) 
   + Peran **AWSControlTowerAdmin**AWSControlTowerCloudTrailRole****, **AWSControlTowerConfigAggregatorRoleForOrganizations**,, dan **AWSControlTowerStackSetRole**layanan. 

     Untuk informasi tentang cara AWS Control Tower menggunakan peran ini untuk melakukan panggilan API landing zone, lihat [Langkah 1: Mengonfigurasi landing zone Anda](lz-api-prereques.md). 

   ```
   Parameters:
     LoggingAccountEmail:
       Type: String
       Description: The email Id for centralized logging account
     LoggingAccountName:
       Type: String
       Description: Name for centralized logging account
     SecurityAccountEmail:
       Type: String
       Description: The email Id for security roles account
     SecurityAccountName:
       Type: String
       Description: Name for security roles account
   Resources:
     MyOrganization:
       Type: 'AWS::Organizations::Organization'
       Properties:
         FeatureSet: ALL
     LoggingAccount:
       Type: 'AWS::Organizations::Account'
       Properties:
         AccountName: !Ref LoggingAccountName
         Email: !Ref LoggingAccountEmail
     SecurityAccount:
       Type: 'AWS::Organizations::Account'
       Properties:
         AccountName: !Ref SecurityAccountName
         Email: !Ref SecurityAccountEmail
     AWSControlTowerAdmin:
       Type: 'AWS::IAM::Role'
       Properties:
         RoleName: AWSControlTowerAdmin
         AssumeRolePolicyDocument:
           Version: 2012-10-17		 	 	 
           Statement:
             - Effect: Allow
               Principal:
                 Service: controltower.amazonaws.com
               Action: 'sts:AssumeRole'
         Path: '/service-role/'
         ManagedPolicyArns:
           - !Sub >-
             arn:${AWS::Partition}:iam::aws:policy/service-role/AWSControlTowerServiceRolePolicy
     AWSControlTowerAdminPolicy:
       Type: 'AWS::IAM::Policy'
       Properties:
         PolicyName: AWSControlTowerAdminPolicy
         PolicyDocument:
           Version: 2012-10-17		 	 	 
           Statement:
             - Effect: Allow
               Action: 'ec2:DescribeAvailabilityZones'
               Resource: '*'
         Roles:
           - !Ref AWSControlTowerAdmin
     AWSControlTowerCloudTrailRole:
       Type: 'AWS::IAM::Role'
       Properties:
         RoleName: AWSControlTowerCloudTrailRole
         AssumeRolePolicyDocument:
           Version: 2012-10-17		 	 	 
           Statement:
             - Effect: Allow
               Principal:
                 Service: cloudtrail.amazonaws.com
               Action: 'sts:AssumeRole'
         Path: '/service-role/'
     AWSControlTowerCloudTrailRolePolicy:
       Type: 'AWS::IAM::Policy'
       Properties:
         PolicyName: AWSControlTowerCloudTrailRolePolicy
         PolicyDocument:
           Version: 2012-10-17		 	 	 
           Statement:
             - Action:
                 - 'logs:CreateLogStream'
                 - 'logs:PutLogEvents'
               Resource: !Sub >-
                 arn:${AWS::Partition}:logs:*:*:log-group:aws-controltower/CloudTrailLogs:*
               Effect: Allow
         Roles:
           - !Ref AWSControlTowerCloudTrailRole
     AWSControlTowerConfigAggregatorRoleForOrganizations:
       Type: 'AWS::IAM::Role'
       Properties:
         RoleName: AWSControlTowerConfigAggregatorRoleForOrganizations
         AssumeRolePolicyDocument:
           Version: 2012-10-17		 	 	 
           Statement:
             - Effect: Allow
               Principal:
                 Service: config.amazonaws.com
               Action: 'sts:AssumeRole'
         Path: '/service-role/'
         ManagedPolicyArns:
           - !Sub arn:${AWS::Partition}:iam::aws:policy/service-role/AWSConfigRoleForOrganizations
     AWSControlTowerStackSetRole:
       Type: 'AWS::IAM::Role'
       Properties:
         RoleName: AWSControlTowerStackSetRole
         AssumeRolePolicyDocument:
           Version: 2012-10-17		 	 	 
           Statement:
             - Effect: Allow
               Principal:
                 Service: cloudformation.amazonaws.com
               Action: 'sts:AssumeRole'
         Path: '/service-role/'
     AWSControlTowerStackSetRolePolicy:
       Type: 'AWS::IAM::Policy'
       Properties:
         PolicyName: AWSControlTowerStackSetRolePolicy
         PolicyDocument:
           Version: 2012-10-17		 	 	 
           Statement:
             - Action: 'sts:AssumeRole'
               Resource: !Sub 'arn:${AWS::Partition}:iam::*:role/AWSControlTowerExecution'
               Effect: Allow
         Roles:
           - !Ref AWSControlTowerStackSetRole
   
   Outputs:
     LogAccountId:
       Value:
         Fn::GetAtt: LoggingAccount.AccountId
       Export:
         Name: LogAccountId
     SecurityAccountId:
       Value:
         Fn::GetAtt: SecurityAccount.AccountId
       Export:
         Name: SecurityAccountId
   ```

# Buat landing zone baru menggunakan CloudFormation
<a name="lz-apis-cfn-launch"></a>

Dari CloudFormation konsol atau menggunakan AWS CLI, gunakan CloudFormation template berikut untuk membuat landing zone. 

```
Parameters:
  Version:
    Type: String
    Description: The version number of Landing Zone
  GovernedRegions:
    Type: Array
    Description: List of governed regions
  SecurityOuName:
    Type: String
    Description: The security Organizational Unit name
  SandboxOuName:
    Type: String
    Description: The sandbox Organizational Unit name
  CentralizedLoggingAccountId:
    Type: String
    Description: The AWS account ID for centralized logging
  SecurityAccountId:
    Type: String
    Description: The AWS account ID for security roles
  LoggingBucketRetentionPeriod:
    Type: Number
    Description: Retention period for centralized logging bucket
  AccessLoggingBucketRetentionPeriod:
    Type: Number
    Description: Retention period for access logging bucket
  KMSKey:
    Type: String
    Description: KMS key ARN used by CloudTrail and Config service to encrypt data in logging bucket
Resources:
  MyLandingZone:
    Type: 'AWS::ControlTower::LandingZone'
    Properties:
      Version:
        Ref: Version
      Tags:
        - Key: "keyname1"
          Value: "value1"
        - Key: "keyname2"
          Value: "value2"
      Manifest:
        governedRegions:
          Ref: GovernedRegions
        organizationStructure:
          security:
            name:
              Ref: SecurityOuName
          sandbox:
            name:
              Ref: SandboxOuName
        centralizedLogging:
          accountId:
            Ref: CentralizedLoggingAccountId
          configurations:
            loggingBucket:
              retentionDays:
                Ref: LoggingBucketRetentionPeriod
            accessLoggingBucket:
              retentionDays:
                Ref: AccessLoggingBucketRetentionPeriod
            kmsKeyArn:
              Ref: KMSKey    
          enabled: true
        securityRoles:
          accountId:
            Ref: SecurityAccountId
        accessManagement:
          enabled: true
```

# Mengelola landing zone yang ada menggunakan CloudFormation
<a name="lz-apis-cfn-launch-existing"></a>

Anda dapat menggunakan CloudFormation untuk mengelola landing zone yang telah diluncurkan dengan mengimpor landing zone di CloudFormation tumpukan baru atau yang sudah ada. Tinjau [Membawa sumber daya yang ada ke dalam CloudFormation manajemen](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/resource-import.html) untuk detail dan instruksi. 

Untuk [mendeteksi dan menyelesaikan drift dalam landing zone](https://docs.aws.amazon.com/controltower/latest/userguide/drift.html), Anda dapat menggunakan konsol AWS Control Tower, the AWS CLI, atau [`ResetLandingZone`API](lz-api-reset.md).