AWS controltower: Control Tower doc history: AFT plan-only customization runs
Summary
Adds a documentation-history entry noting that Account Factory for Terraform (AFT) now supports plan-only (read-only) customization runs via the `plan_only` input, with plan output exported to an encrypted Amazon S3 bucket by default on the Community Edition distribution and opt-in on Terraform Cloud/Enterprise.
Security assessment
This is a changelog entry announcing a read-only plan mode and encrypted S3 export of plan output. It mentions encryption and read-only behavior but documents a feature release, not a fix for a specific vulnerability or a new security control; no CVE or incident is referenced.
Evidence
+Account Factory for Terraform (AFT) supports plan-only customization runs| AFT now supports plan-only (read-only) customization runs through the `plan_only` input to the `aft-invoke-customizations` state machine. AFT exports the plan output to an encrypted Amazon S3 bucket by default on the Community Edition (open source) distribution. Export is opt-in on Terraform Cloud and Terraform Enterprise.| September 16, 2026
Diff
diff --git a/controltower/latest/userguide/doc-history.md b/controltower/latest/userguide/doc-history.md index f6f7035..3df2322 100644 --- a//controltower/latest/userguide/doc-history.md +++ b//controltower/latest/userguide/doc-history.md @@ -17,0 +18 @@ Change| Description| Date +Account Factory for Terraform (AFT) supports plan-only customization runs| AFT now supports plan-only (read-only) customization runs through the `plan_only` input to the `aft-invoke-customizations` state machine. AFT exports the plan output to an encrypted Amazon S3 bucket by default on the Community Edition (open source) distribution. Export is opt-in on Terraform Cloud and Terraform Enterprise.| September 16, 2026