AWS controltower: Release note: AFT plan-only customization runs
Summary
Adds a January 2026 release-notes entry announcing that Account Factory for Terraform (AFT) now supports plan-only (read-only) customization runs, including optional export of plan JSON to an encrypted S3 bucket.
Security assessment
This is a feature announcement in the changelog. It mentions an encrypted S3 bucket for plan output but does not address a specific vulnerability or incident; it is a capability/UX change with only tangential security relevance.
Evidence
+The AWS Control Tower account customization framework, Account Factory for Terraform (AFT), now supports plan-only (read-only) customization runs. You can pass the `plan_only` input to the `aft-invoke-customizations` state machine to preview the Terraform changes an account would receive.
Diff
diff --git a/controltower/latest/userguide/2026-all.md b/controltower/latest/userguide/2026-all.md index a7f773f..419931d 100644 --- a//controltower/latest/userguide/2026-all.md +++ b//controltower/latest/userguide/2026-all.md @@ -7 +7 @@ -AWS Control Tower available in the European Sovereign Cloud +Account Factory for Terraform (AFT) supports plan-only customization runsAWS Control Tower available in the European Sovereign Cloud @@ -12,0 +13,2 @@ Since January 2026, AWS Control Tower has released the following updates: + * Account Factory for Terraform (AFT) supports plan-only customization runs + @@ -17,0 +20,10 @@ Since January 2026, AWS Control Tower has released the following updates: +## Account Factory for Terraform (AFT) supports plan-only customization runs + +**September 16, 2026** + +(No update required for AWS Control Tower landing zone.) + +The AWS Control Tower account customization framework, Account Factory for Terraform (AFT), now supports plan-only (read-only) customization runs. You can pass the `plan_only` input to the `aft-invoke-customizations` state machine to preview the Terraform changes an account would receive. This lets you review the changes without applying them. AFT runs `terraform plan` instead of `terraform apply` across all supported Terraform distributions. AFT can export the plan JSON output to an encrypted Amazon S3 bucket in the AFT management account. On the Community Edition (open source) distribution, AFT exports the output by default. On Terraform Cloud and Terraform Enterprise, export is opt-in through `aft_plan_output_export_enabled`, and you can also view results in the HCP Terraform run UI. + +For more information, see [Account customizations](https://docs.aws.amazon.com/controltower/latest/userguide/aft-account-customization-options.html). +