Automate account creation in Control Tower

0

Hi! Recently I've been automating account creation in Control Tower using Service Catalog APIs as it's explained in this docs: https://docs.aws.amazon.com/controltower/latest/userguide/automated-provisioning-walkthrough.html.

Actually, we want to customize our Landing Zone using CfCT (Customization for Control Tower). I was wondering if it is possible to automate account creation using CfCT. I've done a small test deploying a CloudFormation AWS::ServiceCatalog::CloudFormationProvisionedProduct resource but I haven't achieve anything yet. Anyone has any experience with this?

已提問 4 個月前檢視次數 446 次
1 個回答
2

Hi, while it would be possible to do that. Adding Cloudformation to CfCT that creates accounts would not be recommended. CfCT is designed to be triggered by the Control Tower Account creation process. Lifecycle events will be emitted as the account is created, and those are received by CfCT. So you would effectively creating a bit of a loop if you were to request accounts through CfCT. It would look a bit like this {Update CfCT config} -> {Trigger CfCT execution} -> {Control Tower creates account} -> {Trigger CfCT execution}. The first CfCT execution in that path won't apply anything to the new account as it doesn't exist yet.

Having another pipeline or automation process that handles account requests would be a more recommended option. This makes the process modular and easier to change or troubleshoot. So you would have {Account Request Process} -> {Control Tower creates account} -> {CfCT then updates the Account or Landing Zone}. This should stop redundant executions.

profile pictureAWS
已回答 4 個月前

您尚未登入。 登入 去張貼答案。

一個好的回答可以清楚地回答問題並提供建設性的意見回饋,同時有助於提問者的專業成長。

回答問題指南