AWS First Steps
LanguageEnglish
New feature

AWS Control Tower AFT now supports plan-only customization runs

AWS Control Tower Account Factory for Terraform (AFT) now supports plan-only customization runs, allowing administrators to preview Terraform changes before applying them across managed accounts

AWS Control Tower Account Factory for Terraform (AFT) now supports plan-only customization runs, allowing administrators to preview Terraform changes before applying them. Previously, customization calls always triggered a full Terraform apply, making it difficult to verify expected outcomes or detect unintended configuration drift before broad deployments. Plan-only execution enables administrators to trigger Terraform plans for global and account customizations without applying changes, supporting pre-deployment validation, drift detection, and integration with CI/CD review workflows. This feature is compatible with all Terraform distributions supported by AFT, including open-source, Terraform Cloud, and Terraform Enterprise, and is available in all AWS regions where AFT is supported. For more information, see the AFT documentation and AFT 1.22.0 release notes, as well as the AWS Control Tower user guide.

Why it matters

AWS Control Tower AFT is an open-source Terraform module that automates account provisioning and customization in AWS Control Tower environments. This update allows administrators to preview changes before applying them, making pre-deployment validation and detection of unintended configuration drift easier

Regions: Same as AWS Control Tower Account Factory for Terraform

Read the original AWS announcement

Related articles and terms

Building a Multi-Account Environment with AWS Control Tower - Landing Zone and GuardrailsEstablish governance for your multi-account environment with automated landing zone construction and guardrail-based policy enforcement. Also covers automated account creation with Account Factory.AWS Control TowerA service that automates the setup and governance of multi-account AWS environments, centrally managing security and compliance baselinesAWS Multi-Account Governance - Organizational Control with Organizations, Control Tower, and SCPsThis article examines the multi-account governance mechanisms centered on AWS Organizations, Control Tower, and SCPs (Service Control Policies), comparing them with Azure Management Groups to explain the differences in enterprise governance design capabilities.Practicing Infrastructure as Code with AWS CloudFormation - Template Design and Stack ManagementDefine infrastructure with templates and preview impact with change sets before deployment. Detect configuration drift with drift detection and deploy across your entire organization with StackSets.AWS IaC Maturity - The Advantage of Declarative Infrastructure Management with CloudFormation, CDK, and SAMExamine the maturity of AWS's Infrastructure as Code ecosystem centered on CloudFormation, CDK, and SAM, compared with Azure ARM/Bicep and GCP Deployment Manager, and how CDK's multi-language support transforms the developer experience.