NOTE: https://github.com/aws-ia/terraform-aws-control_tower_account_factory.git

Step 1: Deploy Packaging Module

• Module: packaging

• Source: ./modules/aft-archives

• Purpose: Package Lambda archives and artifacts.

• Command:

    terraform apply -target=module.packaging
  

• Outcome: Artifact files (Lambda zips) uploaded and ready.

---

Step 2: Deploy Account Request Framework

• Module: aft_account_request_framework

• Source: ./modules/aft-account-request-framework

• Purpose: Manage account request lifecycle (DynamoDB, queues, SNS, VPC).

• Dependencies: Needs packaging artifacts from Step 1.

• Command:

    terraform apply -target=module.aft_account_request_framework
  

• Outcome: Core request infrastructure deployed.

---

Step 3: Deploy Lambda Layer Module

• Module: aft_lambda_layer

• Source: ./modules/aft-lambda-layer

• Purpose: Create shared Lambda layer.

• Dependencies: Uses keys, VPC, archives from Steps 1 and 2.

• Command:

    terraform apply -target=module.aft_lambda_layer
  

• Outcome: Shared Lambda layer ready for provisioning Lambdas.

---

Step 4: Deploy Account Provisioning Framework

• Module: aft_account_provisioning_framework

• Source: ./modules/aft-account-provisioning-framework

• Purpose: Step Functions and Lambdas that provision accounts.

• Dependencies: Needs SNS, KMS, Lambda layer, archives.

• Command:

    terraform apply -target=module.aft_account_provisioning_framework
  

• Outcome: Account provisioning automation deployed.

---

Step 5: Deploy Backend Infrastructure

• Module: aft_backend

• Source: ./modules/aft-backend

• Purpose: S3 buckets and DynamoDB tables for state and config.

• Dependencies: Independent but needed early.

• Command:

    terraform apply -target=module.aft_backend
  

• Outcome: Persistent backend storage ready.

---

Step 6: Deploy Code Repositories

• Module: aft_code_repositories

• Source: ./modules/aft-code-repositories

• Purpose: Create/configure repos for provisioning/customization code.

• Dependencies: Needs VPC info and backend from Steps 2 and 5.

• Command:

    terraform apply -target=module.aft_code_repositories
  

• Outcome: Code repos provisioned.

---

Step 7: Deploy Customizations

• Module: aft_customizations

• Source: ./modules/aft-customizations

• Purpose: Pipelines and orchestration for account customizations.

• Dependencies: Needs backend, provisioning framework, repos.

• Command:

    terraform apply -target=module.aft_customizations
  

• Outcome: Customization pipelines set.

---

Step 8: Deploy Feature Options

• Module: aft_feature_options

• Source: ./modules/aft-feature-options

• Purpose: Optional features (CloudTrail, support, default VPC deletion).

• Dependencies: After provisioning framework and customizations.

• Command:

    terraform apply -target=module.aft_feature_options
  

• Outcome: Optional features enabled.

---

Step 9: Deploy IAM Roles

• Module: aft_iam_roles

• Source: ./modules/aft-iam-roles

• Purpose: IAM roles for cross-account access.

• Dependencies: Needs foundational accounts ready.

• Command:

    terraform apply -target=module.aft_iam_roles
  

• Outcome: IAM roles deployed.

---

Step 10: Deploy SSM Parameters

• Module: aft_ssm_parameters

• Source: ./modules/aft-ssm-parameters

• Purpose: Store configs in SSM Parameter Store.

• Dependencies: Needs outputs from nearly all other modules.

• Command:

    terraform apply -target=module.aft_ssm_parameters
  

• Outcome: Configuration parameters stored centrally.

---

Optional: Full deployment

Once you have tested the modules individually in order, you can deploy all with:

terraform apply

Make sure your terraform.tfvars and backend config are correctly set up.

---

If you want, I can help prepare a sample Terraform workflow or scripts to automate these steps! Would you like that?

You said:

yes, please

ChatGPT said:

Awesome! Here’s a simple Bash script you can run in your AFT Terraform root folder to deploy the modules in the correct order automatically.

---

#!/bin/bash

set -e  # Exit on any error

echo "Starting AFT modules deployment..."

declare -a modules=(
  "module.packaging"
  "module.aft_account_request_framework"
  "module.aft_lambda_layer"
  "module.aft_account_provisioning_framework"
  "module.aft_backend"
  "module.aft_code_repositories"
  "module.aft_customizations"
  "module.aft_feature_options"
  "module.aft_iam_roles"
  "module.aft_ssm_parameters"
)

for mod in "${modules[@]}"
do
  echo "Deploying $mod ..."
  terraform apply -auto-approve -target=$mod
  echo "$mod deployed successfully."
done

echo "All AFT modules deployed!"

---

How to use:

1. Save this script as deploy_aft_modules.sh in your Terraform root directory.

2. Make it executable:

bashCopyEditchmod +x deploy_aft_modules.sh

3. Run the script:

bashCopyEdit./deploy_aft_modules.sh

---

Notes:

• The script uses -auto-approve to avoid manual confirmation at each step.

• It deploys modules one by one in the exact order required by dependencies.

• If any step fails, the script will exit immediately (set -e).

• Make sure your Terraform backend is configured and terraform init has been run before this.

• Adjust module names if your Terraform module blocks use different names.