AWS controltower: Document encrypted AFT plan-output S3 bucket and export options
Summary
Adds a feature-options section describing the AFT plan-output S3 bucket (KMS-encrypted, versioned, public access blocked, write access limited to the AFT build role), export enablement variables, and 30-day retention.
Security assessment
Explicitly documents security controls for the new plan-output bucket: KMS encryption, versioning, blocked public access, and least-privilege write access. This is security best-practice documentation rather than a fix for a specific vulnerability.
Evidence
+ * Encrypted with the AFT AWS KMS key
Diff
diff --git a/controltower/latest/userguide/aft-feature-options.md b/controltower/latest/userguide/aft-feature-options.md index a767c13..faebbf7 100644 --- a//controltower/latest/userguide/aft-feature-options.md +++ b//controltower/latest/userguide/aft-feature-options.md @@ -7 +7 @@ -AWS CloudTrail data eventsAWS Enterprise Support planDelete the AWS default VPC +AWS CloudTrail data eventsAWS Enterprise Support planDelete the AWS default VPCExport Terraform plan output to Amazon S3 @@ -22,0 +23,2 @@ These features are not enabled by default. You must explicitly enable each one i + * Export Terraform plan output to Amazon S3 + @@ -126,0 +129,38 @@ Default VPC deletion is best-effort per AWS Region. If a Region's endpoint is te +## Export Terraform plan output to Amazon S3 + +When you deploy AFT, AFT creates a dedicated, encrypted plan-output Amazon S3 bucket in the AFT management account. AFT creates this bucket on every AFT deployment, regardless of your Terraform distribution. The bucket stores the JSON output of plan-only customization runs. For more information about plan-only runs, see [Re-invoke customizations](./aft-account-customization-options.html#aft-re-invoke-customizations). + +The plan-output bucket has the following properties: + + * Encrypted with the AFT AWS KMS key + + * Versioning enabled + + * Public access blocked + + * Write access limited to the AFT customizations build role + + + + +Whether AFT exports the plan JSON to this bucket depends on your Terraform distribution: + + * Community Edition (open source): AFT exports the plan JSON to the bucket by default on every plan-only run. + + * HCP Terraform (Terraform Cloud) and Terraform Enterprise: You can view the plan results in the HCP Terraform run UI. To also export the plan JSON to the bucket, set the following variable to `true` in your AFT deployment input configuration. + + + + + + aft_plan_output_export_enabled = true + +AFT retains exported plans for 30 days by default. To change the retention duration, set the `aft_plan_output_retention_days` variable in your AFT deployment input configuration. + + + aft_plan_output_retention_days = 30 + +###### Note + +The `aft_plan_output_export_enabled` variable affects only the HCP Terraform (Terraform Cloud) and Terraform Enterprise distributions. On the Community Edition (open source) distribution, AFT exports the plan JSON by default, and this variable has no effect. +