AWS controltower documentation change

Service: controltower · 2025-05-25 · Documentation medium

File: controltower/latest/userguide/aft-update-account.md

Summary

Added documentation for updating account alternate contacts using SSM parameters and Terraform configurations

Security assessment

While documenting alternate contact configuration improves account security practices, there's no evidence this addresses a specific security vulnerability. The change provides operational guidance rather than patching a security issue.

Diff

diff --git a/controltower/latest/userguide/aft-update-account.md b/controltower/latest/userguide/aft-update-account.md
index a1d9a8031..64d908691 100644
--- a//controltower/latest/userguide/aft-update-account.md
+++ b//controltower/latest/userguide/aft-update-account.md
@@ -12,0 +13,45 @@ You can update accounts that AFT provisions by editing previously submitted acco
+For example, to update the name or email address of an AFT account, you can define the specifics as `custom_fields` in the Account Request file. By doing so, you create SSM parameters, which you can pass into the `aws_account_alternate_contact` resource during global customizations.
+    
+    
+    resource "aws_account_alternate_contact" "operations" {
+    
+      alternate_contact_type = "OPERATIONS"
+    
+      name          = "Example"
+      title         = "Example"
+      email_address = "[email protected]"
+      phone_number  = "+1234567890"
+    }
+
+You can add similar fields for other contact types, such as operations and security. In Global Customizations, add data lookups for each custom field, to ensure that you look up all the fields you created in Account Request:
+    
+    
+    data "aws_ssm_parameter" "billing_name" {
+                name = "/aft/account-request/custom-fields/billing_name"
+                }
+                
+                data "aws_ssm_parameter" "billing_title" {
+                name = "/aft/account-request/custom-fields/billing_title"
+                }
+                
+                data "aws_ssm_parameter" "billing_email_address" {
+                name = "/aft/account-request/custom-fields/billing_email_address"
+                }
+                
+                data "aws_ssm_parameter" "billing_phone_number" {
+                name = "/aft/account-request/custom-fields/billing_phone_number"
+                }
+
+Finally, also in the Global Customizations file, create the alternate contact resources. You will need to define one of these blocks for every contact type you created in Account Request:
+    
+    
+    resource "aws_account_alternate_contact" "billing" {
+                
+                alternate_contact_type = "BILLING"
+                
+                name          = data.aws_ssm_parameter.billing_name.value
+                title         = data.aws_ssm_parameter.billing_title.value
+                email_address = data.aws_ssm_parameter.billing_email_address.value
+                phone_number  = data.aws_ssm_parameter.billing_phone_number.value
+                }
+