Repository navigation
Releases
Releases · aws-ia/terraform-aws-control_tower_account_factory
1.23.0
- Change: AFT's CodeBuild projects now use the Amazon Linux 2023 standard image (
aws/codebuild/amazonlinux-x86_64-standard:5.0) instead of the Amazon Linux 2 image (aws/codebuild/amazonlinux2-x86_64-standard:5.0). This applies to the account request, account provisioning customizations, global customizations, account customizations, customizations pipeline creation, and Lambda layer build projects. If yourpre-api-helpers.shorpost-api-helpers.shscripts rely on tools specific to Amazon Linux 2, confirm they work on Amazon Linux 2023 before you upgrade. (#560) - Bug fix: Fixed an issue where AFT did not retain an account's cached Enterprise Support enrollment status when re-running account provisioning, causing repeated Support API calls and, if those calls were throttled, duplicate enrollment cases. (#523, #595, #642)
- Dependencies: Updated the certifi, urllib3, virtualenv, and filelock dependencies. (#653)
1.22.0
- AFT can now perform a plan-only (read-only) run of your customizations, so you can preview the Terraform changes an account would receive without applying them. Previously, invoking customizations always ran a full apply. To trigger a plan-only run, pass "plan_only": true in the input when you start the customizations state machine (aft-invoke-customizations). AFT then runs terraform plan for your global and account customizations instead of terraform apply. This works across all supported Terraform distributions (open source, Terraform Cloud, and Terraform Enterprise).
- On the Terraform Cloud/Enterprise path, AFT can optionally export each plan's JSON output to a dedicated, encrypted plan-output S3 bucket in the AFT management account. The bucket is encrypted with the AFT KMS key, is versioned, blocks public access, and limits writes to the AFT customizations build role. Export is off by default; to enable it, set aft_plan_output_export_enabled = true in your AFT deployment. When export is disabled, plan results remain viewable in the HCP Terraform run UI. Exported plans are retained for 30 days by default. To change this duration, use the new aft_plan_output_retention_days variable.
- Bugfix: Fix an issue where account provisioning could fail in split-stage pipelines (where terraform plan and terraform apply run on separate filesystems) because the Lambda deployment archives generated at plan time were missing at apply time. (#633)
- Bugfix: Fix an issue where a fresh AFT deployment could fail to configure replication on its Terraform state backend buckets because replication was configured before bucket versioning was enabled.
1.21.1
1.21.0
- AFT can now re-apply an account's customizations when the account is moved to a different organizational unit (OU). Previously, moving an enrolled account between OUs did not re-apply its customizations. Now, you can opt in to automatic re-application by setting
aft_customization_triggers = ["account_move"]in your AFT deployment.- Note: When AFT re-applies customizations from a trigger, it skips the account provisioning (bootstrap) phase and runs only your global and account customizations to improve performance (see below).
- Note: This behavior applies to all AFT managed accounts. To exclude a specific account after enabling this feature, set
account_skip_customization_triggers = "true"on that account's request file in theaft-account-requestrepository.
- AFT can now bypass the account provisioning (bootstrap) phase on demand, outside of a trigger, by passing
"bypass_steps": ["provisioning_bootstrap"]in the input when you start the customizations (aft-invoke-customizations) state machine. AFT then runs only your global and account customizations.- Note: The bootstrap phase is what creates and repairs an account's AFT resources, including its account customization pipeline. If you bypass the bootstrap on an account whose AFT resources have been deleted or modified, the customizations run can fail, because AFT does not recreate those resources during a bypassed run. Only pass
bypass_stepswhen the account's AFT resources are known to be intact.
- Note: The bootstrap phase is what creates and repairs an account's AFT resources, including its account customization pipeline. If you bypass the bootstrap on an account whose AFT resources have been deleted or modified, the customizations run can fail, because AFT does not recreate those resources during a bypassed run. Only pass
- AFT now supports custom Terraform Cloud/Enterprise workspace names for the account request and account provisioning customizations operations, through the new
account_request_workspace_nameandaccount_provisioning_customizations_workspace_namevariables. (#613)- Note: Changing a workspace name on an existing deployment creates a new workspace and orphans the old one; it is not an in-place rename.
- Strengthen protection of your AFT logs by ensuring the AFT logging bucket and its encryption key only allow access from accounts within your AWS organization.
- Improve how AFT scales when enrolling large numbers of accounts in Enterprise Support concurrently. AFT now caches each account's enrollment status. (#595, #523)
- Migrate to reading Account
Statefield in AWS Organizations API responses (#627) - Bugfix: Fix an issue where upgrading AFT could leave the Lambda layer out of sync with the function code, causing account provisioning to fail with a Python import error. (#625, #520)
- Bugfix: Fix an issue where a fresh AFT deployment could intermittently fail while enabling access logging on its S3 buckets.
1.20.1
- Align all AFT S3 access log destination buckets to use SSE-KMS encryption with the AFT-managed CMK and enable S3 Bucket Keys for reduced KMS request costs. (#339)
- Delete the CloudTrail trail when
aft_feature_cloudtrail_data_eventsis set to false. Previously, disabling this feature option stopped creating new trails but did not remove existing ones. Existing trail data and the S3 bucket are retained. (#620) - Gracefully skip unreachable AWS regions during default VPC deletion instead of failing the entire operation. (#622)
- Update
urllib3andidnadependencies
1.20.0
- Improve account request processing time for customers with a large number of enrolled accounts. Enrollment checks now complete in constant time regardless of fleet size.
- Add configurable DynamoDB backup schedule via new backup_schedule variable. Defaults to hourly to preserve existing behavior. (#596)
- Environment variables set in pre-api-helpers.sh and post-api-helpers.sh now persist across customization buildspec phases. See api_helpers/ in your account or global customizations repo. (#345)
- Enable S3 Bucket Keys on AFT-managed buckets to reduce KMS request costs. (#339)
- Raise minimum Terraform version to 1.6.1. Terraform versions below 1.6.1 can no longer verify HashiCorp provider signatures due to a GPG key rotation. (hashicorp/terraform#34004)
- Upgrade requests, black, pygments, and pytest dependencies
- Improve log output sanitization.
- Bugfix: Fix TFC/TFE workspace runs stalling when cost estimation or policy checks are enabled. (#608)
- Bugfix: Fix CloudTrail event selector to properly exclude S3 data events when using advanced event selectors. (#513)
- Bugfix: Fix ct_management session typo.
- Bugfix: Fix archive_file resources recreating on every apply. (#555)
- Update CODEOWNERS
1.19.0
-
Add OpenID Connect (OIDC) integration support for Terraform Enterprise and HCP Terraform workspaces. Customers can now deploy AWS resources without managing short-lived credentials by setting terraform_oidc_integration = true. This establishes a trust relationship between AWS and your Terraform workspaces using OIDC, replacing the existing approach of storing AWS access keys in Terraform. (#318)
- Note: if you are currently leveraging an OIDC provider for Terraform in the AFT management account, you must delete that provider prior to opting-in to this integration. AFT will re-create that provider for you upon deployment.
- For more details, see: https://docs.aws.amazon.com/controltower/latest/userguide/aft-getting-started.html#aft-configure-and-launch
-
Remove ScanProvisionedProducts API pre-check and hard concurrency limit. AFT no longer calls ScanProvisionedProducts on every account request invocation, reducing Service Catalog API call volume. This change improves performance for customers with many enrolled accounts. Removes the concurrent_account_factory_actions limit — AFT now relies on native Service Catalog concurrency controls modifiable via Service Quota.
-
Cache provisioned_product_exists result during account request processing, reducing API calls in the import-existing-account flow by 50%.
-
Cache SSM parameter values within Lambda invocations. SSM parameters are now fetched once per Lambda execution, reducing latency.
-
Bugfix: Fix custom field SSM parameters being deleted and re-created on every provisioning run. (#531)
-
Bugfix: Fix S3 access logs bucket KMS key policy missing logging.s3.amazonaws.com permissions. (#526)
-
Bugfix: Fix hardcoded concurrency threshold in invoke_customizations Step Function that ignored the maximum_concurrent_customizations setting. The threshold now correctly uses the configured value for all batches of customizations. (#604)
-
Update
blackdependency
