- 最新
- 投票最多
- 评论最多
AFT does provide a number of ways to customize your needs, since your scenario need to run customization when the account in provisioned, you can use AFT account provisioning customizations which runs before any customizations is run after account is provisioned and enrolled in Control Tower. The AFT account provisioning customizations uses “aft-account-provisioning-customizations” Step-Function. To achieve your scenario you can modify “aft-account-provisioning-customizations” Step-Function and write the logic to create TAG policy. You can have a look at one of the sample example which uses AFT customization [1] to Update AWS Alternate Contacts to get the fair idea of “aft-account-provisioning-customizations” working.
Alternatively you can enroll Control Tower management account in AFT and write customization code to create tag policy, however the pipeline will have to invoke separately [2].
References:
[1] https://catalog.workshops.aws/control-tower/en-US/customization/aft/customizations