AWS Control Tower VPC: Do vpc configuration changes propagate to accounts after they have been created?

Question

For example,
- I created a account, "ABC", through account factory with a control tower vpc with no public internet access.  
- I modified account factory vpc to HAVE public internet access
- I updated account "ABC" in control tower
- Account "ABC" still has no public internet access with a NAT

Should i expect accounts to receive control tower vpc configuration changes after account creation?

Answer

Hi There

Control Tower does not detect drift in existing accounts when you update the Account Factory VPC settings, therefore an account update wont change the VPC settings in the existing account.  In this scenario you may want to consider one of the customization approaches like [AFT](https://docs.aws.amazon.com/controltower/latest/userguide/aft-overview.html) or [CfCT](https://docs.aws.amazon.com/controltower/latest/userguide/cfct-overview.html) to provision your accounts with custom resources and keep them all in sync.

AWS Control Tower VPC: Do vpc configuration changes propagate to accounts after they have been created?

Relevant content