AWS Security ChangesHomeSearch

AWS controltower documentation change

Service: controltower · 2025-10-19 · Documentation low

File: controltower/latest/userguide/af-customization-page.md

Summary

Added section 'Transition to External product type' with steps to migrate Terraform Open Source blueprints to External product type in AWS Service Catalog

Security assessment

The changes document a product type transition process without mentioning security vulnerabilities or patches. Focus is on migration steps rather than addressing security flaws.

Diff

diff --git a/controltower/latest/userguide/af-customization-page.md b/controltower/latest/userguide/af-customization-page.md
index c65223cc3..aa571b27e 100644
--- a//controltower/latest/userguide/af-customization-page.md
+++ b//controltower/latest/userguide/af-customization-page.md
@@ -5 +5 @@
-Considerations for Account Factory Customizations (AFC)In case of a blueprint errorCustomizing your policy document for AFC blueprints based on CloudFormationAdditional permissions required for creating a Terraform-based Service Catalog product
+Considerations for Account Factory Customizations (AFC)In case of a blueprint errorCustomizing your policy document for AFC blueprints based on CloudFormationAdditional permissions required for creating a Terraform-based Service Catalog productTransition to External product type
@@ -67,0 +68,2 @@ Before you begin to create customized accounts with AWS Control Tower Account Fa
+  * Transition to the AWS Service Catalog External product type
+
@@ -244,0 +247,31 @@ For more information about creating Terraform products using the External produc
+## Transition to the AWS Service Catalog External product type
+
+AWS Service Catalog changed support for _Terraform Open Source_ products and provisioned products to a new product type, called _External_. To learn more about this transition, review [Updating existing Terraform Open Source products and provisioned products to the External product type](https://docs.aws.amazon.com/servicecatalog/latest/adminguide/update_terraform_open_source_to_external.html) in the _AWS Service Catalog administrator guide_. 
+
+This change effects existing accounts that you created or enrolled with AWS Control Tower account factory customization. To transition these accounts to the _External_ product type, you need to make changes in both AWS Service Catalog and AWS Control Tower. 
+
+###### To transition to the External product type
+
+  1. Upgrade your existing Terraform Reference Engine for AWS Service Catalog to include support for both _External_ and _Terraform Open Source_ product types. For instructions about updating your Terraform Reference Engine, review the [AWS Service Catalog GitHub Repository](https://github.com/aws-samples/service-catalog-engine-for-terraform-os).
+
+  2. In AWS Service Catalog, duplicate any existing _Terraform Open Source_ products (blueprints), with the duplicates using the new _External_ product type. **Do not terminate the existing Terraform Open Source blueprints**. 
+
+  3. In AWS Control Tower, update each account using a _Terraform Open Source_ blueprint to use the new _External_ blueprint. 
+
+    1. To update a blueprint, you must first remove the _Terraform Open Source_ blueprint completely. For more details, review [Remove a blueprint from an account](https://docs.aws.amazon.com/controltower/latest/userguide/remove-a-blueprint.html). 
+
+    2. Add the new _External_ blueprint to the same account. For more details, review [Add a blueprint to an AWS Control Tower account](https://docs.aws.amazon.com/controltower/latest/userguide/add-blueprint-to-account.html). 
+
+  4. After all accounts using _Terraform Open Source_ blueprints are updated to _External_ blueprints, return to AWS Service Catalog and terminate any products that use _Terraform Open Source_ as the product type.
+
+  5. Going forward, all accounts created or enrolled using AWS Control Tower account factory customization must reference blueprints using the _AWS CloudFormation_ or _External_ product type. 
+
+For blueprints created using the _External_ product type, AWS Control Tower only supports account customizations that use Terraform templates and the Terraform reference engine. To learn more, review [Set up for customization](https://docs.aws.amazon.com/controltower/latest/userguide/afc-setup-steps.html). 
+
+
+
+
+###### Note
+
+AWS Control Tower does not support _Terraform Open Source_ as a product type when creating new accounts. To learn more about these changes, review [Updating existing Terraform Open Source products and provisioned products to the _External_ product type](https://docs.aws.amazon.com/servicecatalog/latest/adminguide/update_terraform_open_source_to_external.html) in the _AWS Service Catalog administrator guide_. AWS Service Catalog will support customers through this product type transition, as needed. Contact your account representative to request assistance.
+