AWS controltower documentation change
Summary
Added section 'Transition to External product type' with steps to migrate Terraform Open Source blueprints to External product type in AWS Service Catalog
Security assessment
The changes document a product type transition process without mentioning security vulnerabilities or patches. Focus is on migration steps rather than addressing security flaws.
Diff
diff --git a/controltower/latest/userguide/af-customization-page.md b/controltower/latest/userguide/af-customization-page.md index c65223cc3..aa571b27e 100644 --- a//controltower/latest/userguide/af-customization-page.md +++ b//controltower/latest/userguide/af-customization-page.md @@ -5 +5 @@ -Considerations for Account Factory Customizations (AFC)In case of a blueprint errorCustomizing your policy document for AFC blueprints based on CloudFormationAdditional permissions required for creating a Terraform-based Service Catalog product +Considerations for Account Factory Customizations (AFC)In case of a blueprint errorCustomizing your policy document for AFC blueprints based on CloudFormationAdditional permissions required for creating a Terraform-based Service Catalog productTransition to External product type @@ -67,0 +68,2 @@ Before you begin to create customized accounts with AWS Control Tower Account Fa + * Transition to the AWS Service Catalog External product type + @@ -244,0 +247,31 @@ For more information about creating Terraform products using the External produc +## Transition to the AWS Service Catalog External product type + +AWS Service Catalog changed support for _Terraform Open Source_ products and provisioned products to a new product type, called _External_. To learn more about this transition, review [Updating existing Terraform Open Source products and provisioned products to the External product type](https://docs.aws.amazon.com/servicecatalog/latest/adminguide/update_terraform_open_source_to_external.html) in the _AWS Service Catalog administrator guide_. + +This change effects existing accounts that you created or enrolled with AWS Control Tower account factory customization. To transition these accounts to the _External_ product type, you need to make changes in both AWS Service Catalog and AWS Control Tower. + +###### To transition to the External product type + + 1. Upgrade your existing Terraform Reference Engine for AWS Service Catalog to include support for both _External_ and _Terraform Open Source_ product types. For instructions about updating your Terraform Reference Engine, review the [AWS Service Catalog GitHub Repository](https://github.com/aws-samples/service-catalog-engine-for-terraform-os). + + 2. In AWS Service Catalog, duplicate any existing _Terraform Open Source_ products (blueprints), with the duplicates using the new _External_ product type. **Do not terminate the existing Terraform Open Source blueprints**. + + 3. In AWS Control Tower, update each account using a _Terraform Open Source_ blueprint to use the new _External_ blueprint. + + 1. To update a blueprint, you must first remove the _Terraform Open Source_ blueprint completely. For more details, review [Remove a blueprint from an account](https://docs.aws.amazon.com/controltower/latest/userguide/remove-a-blueprint.html). + + 2. Add the new _External_ blueprint to the same account. For more details, review [Add a blueprint to an AWS Control Tower account](https://docs.aws.amazon.com/controltower/latest/userguide/add-blueprint-to-account.html). + + 4. After all accounts using _Terraform Open Source_ blueprints are updated to _External_ blueprints, return to AWS Service Catalog and terminate any products that use _Terraform Open Source_ as the product type. + + 5. Going forward, all accounts created or enrolled using AWS Control Tower account factory customization must reference blueprints using the _AWS CloudFormation_ or _External_ product type. + +For blueprints created using the _External_ product type, AWS Control Tower only supports account customizations that use Terraform templates and the Terraform reference engine. To learn more, review [Set up for customization](https://docs.aws.amazon.com/controltower/latest/userguide/afc-setup-steps.html). + + + + +###### Note + +AWS Control Tower does not support _Terraform Open Source_ as a product type when creating new accounts. To learn more about these changes, review [Updating existing Terraform Open Source products and provisioned products to the _External_ product type](https://docs.aws.amazon.com/servicecatalog/latest/adminguide/update_terraform_open_source_to_external.html) in the _AWS Service Catalog administrator guide_. AWS Service Catalog will support customers through this product type transition, as needed. Contact your account representative to request assistance. +