Account Management with Account Factory for Terraform [Demo]
Tags: cloud, automation, terraform, aws
Published: 2023-11-10 09:47:22

## **What is Account Factory For Terraform?**
It is simple to generate and modify new accounts that adhere to your organization's security policies using the **AWS Control Tower Account Factory for Terraform (AFT) Terraform module.** You may take use of Terraform's workflow and Control Tower's governance capabilities by using AFT, which establishes a pipeline for the automatic and reliable generation of AWS Control Tower accounts. This module is maintained by AWS.
This tutorial walks you through the one-time procedures needed to deploy AFT in order to establish the account creation pipeline. Your Control Tower accounts will then be created and customized using AFT. You will deploy the AFT module, go through the customization choices for support accounts, and discover the elements of AFT and its workflow in this lesson.

## **Implementation**
**PREREQUISITES:**
Before we start our walkthrough, there are some prerequisites which are require, they are:

- You should have AWS Control Tower environment deployed and active.
- An AWS Account with credential for non-root user with AdminstratorAccess.
- A new root email address for a new vended AWS account that you’ll submit through AFT.
- A new or existing Organizational Units (OU) governed by AWS Control Tower, which is needed as part of new account request parameter in AFT.
- Integrated development environment (IDE) with Git, Terraform, and AWS Command Line Interface (AWS CLI) installed. Your IDE environment must be configured with AWS credentials to your AFT Management account.
- Make sure to specify the AWS Control Tower home region in the commands where applicable

**STEP 1: Create AWS AFT Organizational Unit and Account**
From now on we will be referencing 2 Account: 

1. **Control Tower management account:** Account in which in which we have launched AWS Control Tower.
2. **Account Factory management account:** This account will be provisioned in this section.

In your Control Tower management account navigate to AWS Control Tower and open Organization from the left pane. Select **Create Resources** and select **Create Organization Unit**.


![Fig 1](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/j3fcmcjzz61dthoc7r0d.png)
Name the OU, we have kept it as **Learn AFT** and then select Root OU as the parent OU.

![Fig 2](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/jsmwz8514zmshbwrsbfc.png)

Now navigate to Account Factory and select **Create Account**.

![Fig 3](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/1yt6b9qrd1nqacgnn13y.png)

In **Account Email** field, enter an email which is not associated with any AWS Account, this will account’s root email address. In **IAM Identity Center user email** enter an email id you have access to. And select Learn AFT as your **Organization Unit**. Fill in all other fields as per your preference.


![Fig 4](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/trmz8e05p2ki6b1kzitz.png)

Account provisioning can take up to **_30 minutes_**.

**Step 2: Clone and Fork Examples with configurations**
We will be working around 5 repositories, one with the AFT module deployment and 4 that the module requires you to define your account specifications in. The first repository [learn-terraform-aws-control-tower-aft](https://github.com/hashicorp/learn-terraform-aws-control-tower-aft), which is one time setup will create the required infrastructure across Control Tower management account & in AFT management account. It will create 327 resources in these accounts and these resources will help us to create an account in our Control Tower and all the Customizations.
AFT supports multiple VCS providers like AWS CodeCommit, GitHub, Bitbucket, and GitHub Enterprise Server. By default, it uses AWS CodeCommit for repositories. In our case, we will use GitHub as VCS.
First Clone the [learn-terraform-aws-control-tower-aft](https://github.com/hashicorp/learn-terraform-aws-control-tower-aft) containing the AFT module configuration in AFT Management Account.
And for the next 4 repositories into your GitHub account.
1. The [learn-terraform-aft-account-request repository](https://github.com/hashicorp/learn-terraform-aft-account-request): provides an example setup for starting AFT-based new account provisioning.
2. The [learn-terraform-aft-global-customizations repository](https://github.com/hashicorp/learn-terraform-aft-global-customizations): provides boilerplate setup for adjustments that will be applied to each account that AFT creates.
3. The [learn-terraform-aft-account-customizations repository](https://github.com/hashicorp/learn-terraform-aft-account-customizations): includes default settings for account-specific adjustments.
4. The [learn-terraform-aft-account-provisioning-customizations repository](https://github.com/hashicorp/learn-terraform-aft-account-provisioning-customizations): provides default settings that can be applied to accounts at provisioning time.
Clone your copies of repositories to your computer.

**Step 3: Deploy AFT module**
The AFT module is maintained by AWS Team, it will deploy multiple services which will help you to provision and customize account in Control Tower.
In your terminal, navigate to the [learn-terraform-aws-control-tower-aft repository](https://github.com/hashicorp/learn-terraform-aws-control-tower-aft) you cloned earlier.
**1. Update AFT module configuration**
Open _main.tf_ file in your IDE, review and configure it according to your requirement. This module provisions resources across the Log, Audit, Control Tower Management, and AFT management accounts in your Landing Zone.
In _terraform.tfvars_ provide your AWS account IDs for _ct_management_account_id, log_archive_account_id, audit_account_id, aft_management_account_id_. For _ct_home_region_, use the same region as the one Control Tower is enabled in. And provide your GitHub username in _github_username_ variable.
By setting feature flags, you may disable the default VPC in accounts or enable CloudTrail recording at the organizational level.
**2. Apply configuration**
After AFT management account is provisioned, we will start deploying AFT module. Configure your terminal with the AWS credentials for a user with **AdminstratorAccess** in your Control Tower management account.
Initialize the configuration to install the AWS provider and download the AFT module by running _terraform init_ command. Now apply your configuration by running _terraform apply_ to provision all the services. Respond _yes_ to confirm the operation. This will take 15 to 20 mins for deployment.

![Fig 5](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/3l9wnkky5nvtxhz6bi4z.png)

**NOTE:** There are lot of Resources which are created and you might not know why they are beneficial like Private Link Interface endpoints and NAT Gateways which incur highest cost. The need of these are because of Private communication to AWS Services privately without using Public endpoints which gives enhanced data protection and security. NAT Gateway is required for AWS CodeBuild to communicate.


3. Review AFT components and workflow
One of the many advantages AFT has over manual provisioning of accounts is the abilty to queue multiple account requests with your configuration. AWS Control Tower currently allows you to create only one account at a time, but AFT uses DynamoDB and SQS to queue your account requests, making batched account creation more efficient.

![Fig 6](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/paps5cneiyzpzpf2jr52.png)

First, you must create an account request file with the required attributes for the account to be provisioned. You must also apply for the customization you wish to apply to the account.

![Fig 7](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/y56f39fm6qfir3rvwygu.png)
 
Once you push your files to GitHub repositories, AFT triggers a workflow that will provision and customize your account.
1. CodePipeline launches CodeBuild projects to populate a DynamoDB table item with your new account information. The new item initializes a Lambda that records your account requests in SQS, allowing you to create many new accounts at the same time.
2. The new SQS messages trigger Lambda functions, which process your account request and begin the account vending process in Control Tower. AFT also created an account-specific pipeline to manage the customization of your new account, as well as an execution role in your new account that it may utilize to customize it.
3. When AFT creates a new account, it triggers Lambda functions, which then activate your account-specific pipeline, which applies global and account-specific customizations. If you use Terraform configuration to generate resources in your account, the state of such resources is stored in S3. AFT applies account changes within your new account using the execution role it generated.

**Enable CodeStar Connection**
We are using GitHub as VCS, we will require CodeStar connection. AFT module sets up a CodeStar Connection, which will watch for the changes to repositories.
Once AFT module sets up AFT management account, login to it and navigate to CodeStar connections in AWSaanagement console and look for ct-aft-github-connection and click on it and select Update pending connection. Follow the workflow to Install a new app and connect it to your personal GitHub account. After configuring it, click Connect to enable the AWS Connector for GitHub.

**Grant AFT access to Service Catalog portfolio**
Log into the Control Tower management account in the AWS console, navigate to Portfolios in the Service Catalog page and click on the AWS Control Tower Account Factory Portfolio__. Select the _Groups, roles, and users_ tab, then click _Add groups, roles, users_. Select the Roles tab, then search for _AWSAFTExecution_. Check the box next to it and click Add access.

Navigate to your CodePipeline page in your AFT management account. Click Release change after selecting the _ct-aft-account-provisioning-customizations pipeline_. Then, click the Release button to restart the process.

**Deploy an account with AFT**
Now we will use AFT to provision a new account in Control Tower. Navigate to your cloned _learn-terraform-aft-account-request repository_. Open _terraform/main.tf_, this will contain an instance of _aft-account-request_. Configure _control_tower_parameters, account_tags, change_management_parameters, custom_fields, account_customizations_name_ attributes according to the requirement. Now push this code to GitHub repository.
AFT CodePipeline AFT created listens for the changes to your account requests and customization repositories. 

**Global customizations**
Global customizations apply to all AFT accounts. This enables you to automatically enforce security standards or provision standardised resources and infrastructure in each new account, making compliance with your organization's standards easier.
Navigate to cloned _learn-terraform-aft-global-customizations repository_. Move into _terraform _folder and create a folder named _main.tf_ and write a terraform configuration file which will have a customization of your requirement. By default, this configuration does not define any global customizations for your account.

**Account customizations**
Account customizations are applied to a specific account or set of accounts by AFT. It uses the customizations defined in the repository whose name you specify in the _account_customizations_name_ input variable.
That input variable's value must correspond to a subfolder in your account customizations repository. Account customizations let you to make specific changes to groups of accounts, such as imposing tougher access guardrails on accounts that manage production resources.
Navigate to the cloned repository named _learn-terraform-aft-account-customizations_ and access the appropriate subfolder based on the specified _account_customizations_name_. Once you're in the correct subfolder, navigate to the _terraform directory_ and open the file named _s3.tf_. Please note that _s3.tf_ is just an example file, and you can modify it according to your specific customization needs.

**Inspect new account**
Verify that AFT created your new account by finding the _AFT managment account_ in the list of accounts in your Control Tower Accounts dashboard.

![Fig 8](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/szt4zyeqoq73nfyb23cu.png)

## **Conclusion**
In conclusion, leveraging the AWS Control Tower Account Factory for Terraform (AFT) brings powerful automation to account creation and customization processes. AFT's ability to queue multiple account requests and apply global and account-specific customizations & Seamlessly integrating Terraform and Control Tower's governance, AFT ensures security policy adherence, efficient workflows, and scalable provisioning. With support for multiple VCS providers like GitHub, businesses can maintain standardized security standards and enhance operational efficiency across their AWS environment.

**_Useful Links_**
- [AWS Blog 1](https://aws.amazon.com/blogs/aws/new-aws-control-tower-account-factory-for-terraform/)
- [AWS Blog 2](https://aws.amazon.com/blogs/mt/deploy-and-customize-aws-accounts-using-account-factory-for-terraform-in-aws-control-tower/)
- [AWS Docs](https://docs.aws.amazon.com/controltower/latest/userguide/taf-account-provisioning.html)
- [AWS re:Invent video](https://www.youtube.com/watch?v=8Ot5wn7kxI0)

**CO FIRST AUTHOR**
- [Rajdeep Jadeja](https://www.linkedin.com/in/rajdeepsinh-jadeja-854b951aa/)