Create/update tag policy via AFT

0

When an account is provisioned in an organization via AFT, is it possible to have an account specific tag policy created and attached to the account as part of the provisioning? Also, when the list of acceptable tags in the policy needs to be updated, can this be done through AFT account customization?

Background info: We need to create a tag policy per account with a list of acceptable tags specific to each account. To manage this manually would be an administrative nightmare :)

Darryl
質問済み 5ヶ月前249ビュー
1回答
0

AFT does provide a number of ways to customize your needs, since your scenario need to run customization when the account in provisioned, you can use AFT account provisioning customizations which runs before any customizations is run after account is provisioned and enrolled in Control Tower. The AFT account provisioning customizations uses “aft-account-provisioning-customizations” Step-Function. To achieve your scenario you can modify “aft-account-provisioning-customizations” Step-Function and write the logic to create TAG policy. You can have a look at one of the sample example which uses AFT customization [1] to Update AWS Alternate Contacts to get the fair idea of “aft-account-provisioning-customizations” working.

Alternatively you can enroll Control Tower management account in AFT and write customization code to create tag policy, however the pipeline will have to invoke separately [2].

References:

[1] https://catalog.workshops.aws/control-tower/en-US/customization/aft/customizations

[2] https://docs.aws.amazon.com/controltower/latest/userguide/aft-account-customization-options.html#aft-re-invoke-customizations

AWS
サポートエンジニア
回答済み 5ヶ月前

ログインしていません。 ログイン 回答を投稿する。

優れた回答とは、質問に明確に答え、建設的なフィードバックを提供し、質問者の専門分野におけるスキルの向上を促すものです。

質問に答えるためのガイドライン

関連するコンテンツ