Create/update tag policy via AFT

0

When an account is provisioned in an organization via AFT, is it possible to have an account specific tag policy created and attached to the account as part of the provisioning? Also, when the list of acceptable tags in the policy needs to be updated, can this be done through AFT account customization?

Background info: We need to create a tag policy per account with a list of acceptable tags specific to each account. To manage this manually would be an administrative nightmare :)

Darryl
已提问 5 个月前249 查看次数
1 回答
0

AFT does provide a number of ways to customize your needs, since your scenario need to run customization when the account in provisioned, you can use AFT account provisioning customizations which runs before any customizations is run after account is provisioned and enrolled in Control Tower. The AFT account provisioning customizations uses “aft-account-provisioning-customizations” Step-Function. To achieve your scenario you can modify “aft-account-provisioning-customizations” Step-Function and write the logic to create TAG policy. You can have a look at one of the sample example which uses AFT customization [1] to Update AWS Alternate Contacts to get the fair idea of “aft-account-provisioning-customizations” working.

Alternatively you can enroll Control Tower management account in AFT and write customization code to create tag policy, however the pipeline will have to invoke separately [2].

References:

[1] https://catalog.workshops.aws/control-tower/en-US/customization/aft/customizations

[2] https://docs.aws.amazon.com/controltower/latest/userguide/aft-account-customization-options.html#aft-re-invoke-customizations

AWS
支持工程师
已回答 5 个月前

您未登录。 登录 发布回答。

一个好的回答可以清楚地解答问题和提供建设性反馈,并能促进提问者的职业发展。

回答问题的准则

相关内容