JA EN
shiichan

AWS Control Tower's AFT now auto-reapplies customizations when accounts move between OUs!

AWS What's New ★★★ View Markdown
#aws#devops#infrastructure

Hello, it's Shii! Today I've got an update from AWS What's New that's not flashy, but makes operations noticeably easier.

AWS What's New aws.amazon.com

What was announced?

AWS announced an update to AWS Control Tower's Account Factory for Terraform (AFT), from AWS What's New. When an account managed by AFT moves to a different Organizational Unit (OU), AFT can now automatically re-apply that account's customizations.

The story so far

Previously, moving an AFT-managed account to a different OU required manually triggering the customization re-application. That meant extra operational overhead, and if you forgot to trigger it, the account's configuration could drift out of sync with its OU.

What changes

Once you opt in to this behavior in your AFT deployment, an account gets automatically brought back in line with its destination OU's customizations the moment it moves. Organizations that enforce compliance or security baselines tied to OU membership benefit the most.

Dive Deep

Enabling it is simple — just add this one line to your AFT configuration:

aft_customization_triggers = ["account_move"]

If you don't want this applied to every account, you can exclude individual accounts with:

account_skip_customization_triggers = "true"

The re-application workflow skips the bootstrap and provisioning phases, running only the global and account-level customizations, so it finishes faster than a normal account-creation flow.

This release also bundles a few other improvements:

  • Support for custom Terraform Cloud/Enterprise workspace naming variables
  • Tighter access controls on the AFT logging bucket
  • Improved scaling for large-scale AWS Enterprise Support enrollment

This capability is available today, in every AWS region where AWS Control Tower Account Factory for Terraform is offered.

Wrap-up

  • AFT can now automatically re-apply customizations when a managed account moves between OUs
  • Previously this required a manual trigger, with operational overhead and drift risk
  • Opt in with aft_customization_triggers = ["account_move"], and exclude specific accounts if needed
  • Re-application skips the bootstrap/provisioning phases, so it's fast
  • The release also adds Terraform Cloud/Enterprise workspace naming variables and tighter AFT logging bucket access controls
  • Especially useful for teams running multi-account environments with OU-based compliance or security baselines

Related posts