JA EN
shiichan

Control Tower AFT Gets Plan-Only Runs: Preview Changes Before You Apply

AWS What's New ★★★★ View Markdown
#aws#devops

Hi, it's Shii-chan! This announcement grants the wish of "let me check before I apply" in multi-account operations!

AWS What's New aws.amazon.com

What was announced?

AWS What's New announced plan-only customization runs for AWS Control Tower Account Factory for Terraform (AFT). AFT is an open-source Terraform module that automates account provisioning and customization in AWS Control Tower environments.

The story so far

Invoking customizations always triggered a full Terraform apply. There was no way to preview changes, so it was hard to validate expected outcomes or catch unintended configuration drift before a broad rollout.

What changes

You can now review changes before they reach your managed accounts!

  • Trigger a Terraform plan for global and account customizations without applying any changes
  • Validate safely before rollout
  • Use it for drift detection
  • Integrate it into CI/CD review workflows

Dive Deep

Here is the scope and the details:

  • Compatible distributions: all AFT-supported Terraform distributions, including open source, Terraform Cloud, and Terraform Enterprise
  • Availability: all Regions where AFT is supported
  • Configuration details are in the AFT documentation and the AFT 1.22.0 release notes

Wrap-up

  • AFT adds plan-only runs that plan without applying
  • Useful for pre-rollout validation, drift detection, and CI/CD review
  • Works with all AFT-supported Terraform distributions

A good fit for admins running many accounts with Control Tower and Terraform!

Related posts