Account Factory for Terraform without Control Tower

Question

We have an existing multi-account  environment with the majority of AWS services, so do not need to use Landing Zone Accelerator (LZA) or AWS Control Tower.  We use Terraform to build resources within the account and would like to use the Account Factory for Terraform [1] and [2] to build an account within the management account and integrate with AWS Organizations.

Can you tell me if it is possible to use AFT in an environment that does not have AWS Control Tower?

[1] https://registry.terraform.io/modules/aws-ia/control_tower_account_factory/aws/latest 
[2] https://aws.amazon.com/blogs/aws/new-aws-control-tower-account-factory-for-terraform/

Thanks

Answer

I believe Control Tower is required to set up AFT and the linkage to AWS Organizations. Step 1 in the AFT setup instructions, https://registry.terraform.io/modules/aws-ia/control_tower_account_factory/aws/latest, is Control Tower setup.

Answer

AFT is a solution built specifically for use with AWS Control Tower (CT).  As you can see in the docs here https://docs.aws.amazon.com/controltower/latest/userguide/aft-getting-started.html there is a distinct requirement for there to be a AWS Control Tower Landing Zone. That said the functionality being built into AWS Control Tower along with the integration capabilities still make it the best option for longer term reduction of operating burden for your environment. There is an easy path to govern an existing org with AWS CT https://docs.aws.amazon.com/controltower/latest/userguide/about-extending-governance.html. If you do deploy CT into an existing organization you still need to manually register OU's and Accounts as they are not automatically enrolled. There are customers that deploy AWS CT in an almost parallel fashion and then slowly ingest OU's and Accounts... or they just use it for new OU's and Accounts.

Account Factory for Terraform without Control Tower

관련 콘텐츠