AWS controltower documentation change
Summary
Restructured deployment steps, added optional configurations for VPC, Terraform project name, and custom tags, and updated documentation for clarity.
Security assessment
The changes introduce documentation for custom tags that can assist with access control and resource management, which is a security-related feature. However, there is no evidence of addressing a specific security vulnerability or incident. The VPC configuration updates focus on cost optimization and deployment flexibility rather than resolving security weaknesses.
Diff
diff --git a/controltower/latest/userguide/aft-getting-started.md b/controltower/latest/userguide/aft-getting-started.md index a511396e2..a70ce7e3a 100644 --- a//controltower/latest/userguide/aft-getting-started.md +++ b//controltower/latest/userguide/aft-getting-started.md @@ -75 +75 @@ It can take up to 30 minutes to fully provision the AFT management account. -**Step 4: Verify the Terraform environment is available for deployment** +**Step 4: Verify that the Terraform environment is available for deployment** @@ -83 +83 @@ AFT supports Terraform Version `1.6.0` or later. -**Step 5: Call the Account Factory for Terraform module to deploy AFT** +**Step 5: Optional configurations** @@ -85,3 +85 @@ AFT supports Terraform Version `1.6.0` or later. -Call the AFT module with the role that you created for the AWS Control Tower management account that has **AdministratorAccess** credentials. AWS Control Tower provisions a Terraform module through the AWS Control Tower management account, which establishes all of the infrastructure required to orchestrate AWS Control Tower Account Factory requests. - -You can view the AFT module in the [AFT repository](https://github.com/aws-ia/terraform-aws-control_tower_account_factory/tree/main) on GitHub. The entire GitHub repository is considered the AFT module. Refer to the [README file](https://github.com/aws-ia/terraform-aws-control_tower_account_factory/blob/main/README.md) for information about the inputs that are required to run the AFT module and deploy AFT. Alternatively, you can view the AFT module in the [Terraform Registry](https://registry.terraform.io/modules/aws-ia/control_tower_account_factory/aws/latest). + * **Optionally set the virtual private cloud (VPC) configuration** @@ -89 +87 @@ You can view the AFT module in the [AFT repository](https://github.com/aws-ia/te -The AFT module includes a `aft_enable_vpc` parameter that specifies if AWS Control Tower provisions account resources within a virtual private cloud (VPC) in the central AFT management account. By default, the parameter is set to `true`. If you set this parameter to `false`, AWS Control Tower deploys AFT _without_ the use of a VPC and private networking resources, such as NAT Gateways or VPC endpoints. Disabling `aft_enable_vpc` may help reduce the operating cost of AFT _for some usage patterns_. +The AFT module includes a `aft_enable_vpc` parameter, which specifies whether AWS Control Tower provisions account resources within a VPC in the central AFT management account. By default, the parameter is set to `true`. If you set this parameter to `false`, AWS Control Tower deploys AFT _without_ the use of a VPC and private networking resources, such as NAT Gateways or VPC endpoints. Disabling `aft_enable_vpc` may help reduce the operating cost of AFT _for some usage patterns_. Adding any VPC configurations overrides the `aft_enable_vpc` parameter being set to `false`. @@ -94,0 +93,79 @@ Re-enabling the `aft_enable_vpc` parameter (switching the value from `false` to +Instead of provisioning a new VPC, you can configure AFT to use an existing VPC in your account. To use your own VPC, provide the following VPC configuration parameters: + + * `aft_customer_vpc_id` \- The ID of your existing VPC + + * `aft_customer_private_subnets` \- A list of private subnet IDs in your VPC + +Example configuration: + + module "aft" { + source = "github.com/aws-ia/terraform-aws-control_tower_account_factory" + + # VPC configuration + aft_customer_vpc_id = "vpc-0123456789abcdef0" + aft_customer_private_subnets = ["subnet-0123456789abcdef0", "subnet-0123456789abcdef1"] + + # Other AFT parameters... + } + + +###### Important + +We don't recommend that you use the custom VPC option if you have an existing AFT deployment. You may have dependencies on Lambda functions or CodePipeline that depend on resources within the underlying existing VPC. + + * **Optionally configure the Terraform project name** + +You can customize the Terraform project name used by AFT by setting the `terraform_project_name` parameter. By default, AFT puts the deployment in the "default" project in Terraform Cloud or Terraform Enterprise. + +Example configuration: + + module "aft" { + source = "github.com/aws-ia/terraform-aws-control_tower_account_factory" + + # Project name configuration + terraform_project_name = "my-organization-aft" + + # Other AFT parameters... + } + + +###### Note + +This parameter is only applicable to Terraform Enterprise or Terraform Cloud deployments. + + * **Optionally apply custom tags to AFT resources** + +You can apply custom tags to all AFT resources by using the `tags` parameter. These tags help with resource organization, cost allocation, and access control. + +Example configuration: + + module "aft" { + source = "github.com/aws-ia/terraform-aws-control_tower_account_factory" + + # Custom tags configuration + tags = { + Environment = "Production" + CostCenter = "IT-12345" + Project = "AFT-Deployment" + Owner = "[email protected]" + } + + # Other AFT parameters... + } + + +These tags are applied to all resources created by the AFT module. AFT automatically adds a `managed_by = "AFT"` tag to all resources, which can't be overridden by custom tags. + +###### Note + +Custom tags can be added at any time, not just during initial deployment. + + + + +**Step 6: Call the Account Factory for Terraform module to deploy AFT** + +Call the AFT module with the role that you created for the AWS Control Tower management account that has **AdministratorAccess** credentials. AWS Control Tower provisions a Terraform module through the AWS Control Tower management account, which establishes all of the infrastructure required to orchestrate AWS Control Tower Account Factory requests. + +You can view the AFT module in the [AFT repository](https://github.com/aws-ia/terraform-aws-control_tower_account_factory/tree/main) on GitHub. The entire GitHub repository is considered the AFT module. Refer to the [README file](https://github.com/aws-ia/terraform-aws-control_tower_account_factory/blob/main/README.md) for information about the inputs that are required to run the AFT module and deploy AFT. Alternatively, you can view the AFT module in the [Terraform Registry](https://registry.terraform.io/modules/aws-ia/control_tower_account_factory/aws/latest). + @@ -103 +180 @@ You might wait up to 30 minutes for AFT to finish deploying through the Terrafor -**Step 6: Manage the Terraform state file** +**Step 7: Manage the Terraform state file** @@ -117 +194 @@ To use the Amazon Web Services Documentation, Javascript must be enabled. Please -Update an existing account +Cost