Account Factory for Terraform without Control Tower

0

We have an existing multi-account environment with the majority of AWS services, so do not need to use Landing Zone Accelerator (LZA) or AWS Control Tower. We use Terraform to build resources within the account and would like to use the Account Factory for Terraform [1] and [2] to build an account within the management account and integrate with AWS Organizations.

Can you tell me if it is possible to use AFT in an environment that does not have AWS Control Tower?

[1] https://registry.terraform.io/modules/aws-ia/control_tower_account_factory/aws/latest [2] https://aws.amazon.com/blogs/aws/new-aws-control-tower-account-factory-for-terraform/

Thanks

已提問 2 年前檢視次數 833 次
2 個答案
0

I believe Control Tower is required to set up AFT and the linkage to AWS Organizations. Step 1 in the AFT setup instructions, https://registry.terraform.io/modules/aws-ia/control_tower_account_factory/aws/latest, is Control Tower setup.

AWS
已回答 1 年前
0

AFT is a solution built specifically for use with AWS Control Tower (CT). As you can see in the docs here https://docs.aws.amazon.com/controltower/latest/userguide/aft-getting-started.html there is a distinct requirement for there to be a AWS Control Tower Landing Zone. That said the functionality being built into AWS Control Tower along with the integration capabilities still make it the best option for longer term reduction of operating burden for your environment. There is an easy path to govern an existing org with AWS CT https://docs.aws.amazon.com/controltower/latest/userguide/about-extending-governance.html. If you do deploy CT into an existing organization you still need to manually register OU's and Accounts as they are not automatically enrolled. There are customers that deploy AWS CT in an almost parallel fashion and then slowly ingest OU's and Accounts... or they just use it for new OU's and Accounts.

AWS
已回答 9 個月前

您尚未登入。 登入 去張貼答案。

一個好的回答可以清楚地回答問題並提供建設性的意見回饋,同時有助於提問者的專業成長。

回答問題指南