Create/update tag policy via AFT

Question

When an account is provisioned in an organization via AFT, is it possible to have an account specific tag policy created and attached to the account as part of the provisioning?
Also, when the list of acceptable tags in the policy needs to be updated, can this be done through AFT account customization?

Background info: We need to create a tag policy per account with a list of acceptable tags specific to each account.  To manage this manually would be an administrative nightmare :)

Answer

AFT does provide a number of ways to customize your needs, since your scenario need to run customization when the account in provisioned, you can use AFT account provisioning customizations which runs before any customizations is run after account is provisioned and enrolled in Control Tower. The AFT account provisioning customizations uses “aft-account-provisioning-customizations” Step-Function. To achieve your scenario you can modify “aft-account-provisioning-customizations” Step-Function and write the logic to create TAG policy. You can have a look at one of the sample example which uses AFT customization [1] to Update AWS Alternate Contacts to get the fair idea of “aft-account-provisioning-customizations” working.

Alternatively you can enroll Control Tower management account in AFT and write customization code to create tag policy, however the pipeline will have to invoke separately [2].

References:

[1] https://catalog.workshops.aws/control-tower/en-US/customization/aft/customizations

[2] https://docs.aws.amazon.com/controltower/latest/userguide/aft-account-customization-options.html#aft-re-invoke-customizations

Alternatively you can enroll Control Tower management account in AFT and write customization code to create tag policy, however the pipeline will have to invoke separately [2].

References:

[1] https://catalog.workshops.aws/control-tower/en-US/customization/aft/customizations

[2] https://docs.aws.amazon.com/controltower/latest/userguide/aft-account-customization-options.html#aft-re-invoke-customizations

Create/update tag policy via AFT

Relevant content