🏗️ Understanding AWS Control Tower Account Factory for Terraform (AFT) – The Easy Way

🔹 What is AWS Control Tower?

AWS Control Tower helps organizations set up and govern a secure multi-account AWS environment using best practices. It provides:

• A Landing Zone with preconfigured organizational units (OUs)

• An Account Factory to create new AWS accounts

• Guardrails for compliance and governance

But… the default Account Factory is not Infrastructure-as-Code friendly.

---

🔹 Introducing AFT (Account Factory for Terraform)

AFT is an AWS solution that enables you to provision AWS accounts in Control Tower using Terraform and GitOps workflows.

✅ Benefits:

• Infrastructure as Code (IaC)

• Automated account creation

• Custom Terraform-based configurations

• GitOps-style management

---

🔄 How AFT Works – High-Level Workflow

Step 1: User submits account request (in Git)
Step 2: AFT reads request and creates account
Step 3: Post-creation: Shared configurations are applied
Step 4: Account-specific customizations are deployed
Step 5: Global customizations run across all accounts

🎯 End result: A fully governed AWS account with your org’s policies and configurations applied automatically.

---

🧱 AFT Architecture Breakdown

AFT is built from multiple Terraform modules. Here’s what each one does — explained in plain English:

---

1. aft-infrastructure

🧰 Sets up the core AFT infrastructure
📦 Creates:

• S3 buckets

• DynamoDB tables

• CodePipelines

• IAM roles

• Lambda functions

---

2. aft-account-request-framework

📬 Reads account requests from Git or DynamoDB
✅ Validates request format
🚀 Triggers account creation via Control Tower

Example account request:

account_email       = "dev@yourcompany.com"
account_name        = "dev-yourteam"
organizational_unit = "Development"

---

3. aft-account-provisioning-customizations

🛠️ Applies shared Terraform modules to every new account right after creation.
Use this for:

• Setting up baseline networking

• Creating shared roles

• Enabling security services

---

4. aft-account-customizations

🎯 Applies account-specific Terraform modules based on Git folder.

Example:

/account-customizations/dev-yourteam/main.tf

Deploy custom:

• VPCs

• ECS clusters

• IAM policies

• SSM documents

---

5. aft-global-customizations

🌍 Applies Terraform changes across all accounts.
Perfect for:

• AWS Config

• GuardDuty

• SecurityHub

• CloudTrail centralization

---

6. aft-code-repositories

📚 Creates the Git repos AFT depends on:

• account-request

• account-customizations

• global-customizations

---

7. aft-feature-options

🧪 Advanced settings and feature toggles, like:

• Async provisioning

• CloudTrail event tracking

• Custom pipelines

---

8. aft-lambda-layer

🧬 Builds a shared Lambda Layer for reusing Python libraries across AFT Lambdas.

---

🔍 Example GitOps Setup

✅ Account Request Repo (account-request)

account_email       = "analytics@example.com"
account_name        = "analytics"
organizational_unit = "BusinessUnit1"

🔧 Customizations Repo (account-customizations)

├── dev-yourteam/
│   └── main.tf    <- VPC, EC2, S3 setup
├── prod-yourteam/
│   └── main.tf    <- Hardened config

🌐 Global Customizations (global-customizations)

main.tf <- AWS Config, GuardDuty, CloudTrail

---

📌 Key Takeaways

• AFT extends Control Tower with Terraform + GitOps.

• Account creation and configuration are fully automated.

• You get repeatable, compliant, and scalable AWS accounts.

• Each AFT module plays a specific role — plug-and-play style.