Creating an AWS account with Terraform moves account provisioning from manual console clicks to repeatable, versioned infrastructure as code. The workflow differs depending on whether you are standing up a single standalone account or provisioning governed accounts inside AWS Control Tower using Account Factory for Terraform. Both paths require correct AWS credentials, a Terraform service principal, remote state storage, and explicit provider configuration.
Introduction
Terraform automates infrastructure provisioning on AWS and reduces manual work and errors. Using infrastructure as code, changes can be tracked and reverted to previous states if necessary. The integration provides automation and efficiency and supports scalability up to demand. To get started, credentials must be set up so Terraform can access an AWS account to create, update, and delete resources.
Log in to the AWS Management Console. Go to Identity and Access Management. Create a new IAM user with programmatic access, which will give an access key ID and a secret access key. Store your credentials securely.
Prerequisites for AWS Control Tower Account Factory for Terraform
AWS Control Tower Account Factory for Terraform is a Terraform module that makes it easy to create and customize new accounts that comply with your organization's security guidelines. AFT defines a pipeline for automated and consistent creation of AWS Control Tower accounts, giving you the benefits of Terraform's workflow and Control Tower's governance features. AWS maintains this module.
This tutorial guides you through the one-time steps required to deploy AFT to create the pipeline for account creation. Then, you will use AFT to create and customize your Control Tower accounts. In this tutorial, you will deploy the AFT module, review the support account customization options, and learn about the components of AFT and its workflow.
This tutorial assumes that you are familiar with the standard Terraform workflow. If you are new to Terraform, complete the Get Started tutorials first.
For this tutorial, you will need:
- Terraform v0.15+ installed locally configured with credentials for the non-root user with AdministratorAccess
- an AWS account, with credentials for a non-root user with the AdministratorAccess policy attached. Some steps can take up to 30 minutes, so make sure your credentials have a long enough duration
Service Account for Terraform on AWS
For Terraform to create resources on your AWS account, it should get some access keys to authenticate to your account. In this step, we will create a service account for Terraform to use.
We will create an admin user group, then create a Terraform user and add it to the admin group. Then create access keys for the Terraform user.
When you are in the AWS Console, search for the IAM service.
Head to "User groups" and click on the "Create group" button.
Enter your group name, search for administratorAccess and select it, and hit the "Create group" button.
Click on the "Users" menu, then click the "Create user" button to create a user for Terraform.
Enter the "User name" and hit the "Next" button.
Add the new user to the group previously created. So the user will have "Administrator Access" permissions.
Review the user and hit "Create user" to continue.
To create a access keys for the new user, hit the username.
Change the tab to "Security credentials" and hit the "Create access key" button.
Change the "Other" type and hit the "Next" button.
You can write a description of why you have created this access key. Hit the "Create access key" button to continue.
Now you can see the access keys. Copy both of them and paste them somewhere else securely. Hit "Done" to continue.
You can use those keys in the Terraform configuration.
Keep these access keys safe and secure
Pro Tip: Store your credentials securely
AFT Architecture and GitOps Model
Customers use AWS Control Tower Account Factory to create a new AWS account or enroll existing AWS accounts in their AWS Organizations. Customers launch Account Factory from the AWS Control Tower console or via AWS Service Catalog API.
We hear from customers that they want to manage their AWS accounts in the same way that they manage their AWS infrastructure using Terraform. We launched AWS Control Tower Account Factory for Terraform at re:Invent 2021, a new Terraform module to provision and customize AWS accounts using Terraform.
AFT follows a GitOps model and sets up a Terraform pipeline to provision and customize AWS accounts in AWS Control Tower. You create an account request in Terraform and commit to the repository that triggers the AFT workflow for Account Factory. After Account Factory execution is complete, AFT runs additional customization steps automatically.
AFT uses four separate repositories to manage this entire workflow.
| Repository | Function |
|---|---|
| aft-account-request | handles placing or updating account requests |
| aft-account-provisioning-customizations | customization steps after Account Factory execution |
| aft-account-customizations | account level customizations per customization name |
| aft-global-customizations | customizations applied to all accounts managed by AFT |
Deploying the AFT Pipeline
Deploy and Customize AWS accounts using Account Factory for Terraform in AWS Control Tower.
AFT follows a GitOps model and sets up a Terraform pipeline to provision and customize AWS accounts in AWS Control Tower.
Account request repo
To create and update the AWS account using AFT, use the aft-account-request Terraform module. Provide the mandatory input, such as account root email address and the OU. Each time that you add or modify the account request, the Terraform file is committed to the repository and will trigger the AFT pipeline.
From the IDE terminal, run the following command to copy the example account customization. Replace the placeholder AWS_REGION value with your Control Tower home region.
Updating to this repository triggers the account request pipeline.
Navigate to CodePipeline and confirm that your ct-aft-account-request pipeline status is Succeeded. It may take a few minutes for the pipeline to complete.
So far, we only populate the boilerplate without yet submitting a real account request. In the next section, we’ll submit a new account request.
After the pipeline has completed successfully, navigate to Step Functions and locate the aft-account-provisioning-customizations state machine.
Provision New Account via AFT
Now we’ll provision a new AWS account via AFT using the SANDOX customization that we configured earlier.
From your IDE, navigate to the aft-account-request/terraform directory.
Create a new file, and give it a name account-requests.tf
Add the following Terraform code and replace the placeholder {{PLACEHOLDER NAME}} with your own value, for example for the account email, name, OU, and SSO
Provision new account
Now we’ll provision a new AWS account via AFT using the SANDOX customization that we configured earlier.
Account Customization and Global Customizations
Open the main.tf file on the aft-account-customizations/SANDBOX/terraform directory. This is a Terraform configuration which sets a monthly budget of $100 on the account that you’re creating with this customization.
Open the api_helpers directory, which is where you add bash/python script to further customize your account.
To add additional account level customization, create a new directory following the same structure. You specify the accountcustomizationname when creating a new account request, and AFT applies all of the Terraform configurations specified in the specific customization directory.
To use custom variables in your Terraform configuration, you pass the custom_fields value during the account request. These custom fields will be available as the AWS Systems Manager Parameter Store in the vended AWS account under path /aft/account-request/custom-fields/{field-name}. In your Terraform configuration, you can retrieve these custom fields using data source.
Global customizations repo
You can apply customizations to all of the accounts managed by AFT. For example, in this post, we’ll configure Amazon S3 Block Public Access to block public access to every Amazon Simple Storage Service bucket in all of the accounts managed by AFT.
From the IDE terminal, run the following command
Standalone AWS Account Creation with Terraform
Create AWS account
Create an AWS account.
Copy the access keys of your root user and add them to your .aws/credentials file.
Set up provider
terraform {
required_version = "~> 1.0.0"
required_providers {
aws = {
source = "hashicorp/aws"
version = "~> 3.0"
}
}
}
provider "aws" {
profile = "your-named-profile"
region = "eu-west-1"
}
Create state bucket
Use the AWS CLI to create an S3 bucket.
```
!/bin/bash
export AWSPROFILE=my-named-profile
BUCKETNAME=terraform-state
BUCKETREGION=eu-west-1
echo Creating bucket
aws s3 mb s3://$BUCKETNAME --region "$BUCKETREGION"
echo Enabling versioning
aws s3api put-bucket-versioning --bucket $BUCKETNAME --versioning-configuration Status=Enabled
echo Enabling encryption
aws s3api put-bucket-encryption --bucket $BUCKETNAME --server-side-encryption-configuration '{"Rules": [{"ApplyServerSideEncryptionByDefault": {"SSEAlgorithm": "AES256"}}]}'
echo Making bucket private
aws s3api put-bucket-acl --bucket $BUCKETNAME --acl private
Echo Finished
```
Update your backend to use the bucket.
terraform {
backend "s3" {
profile = "your-named-profile"
region = "eu-west-1"
bucket = "terraform-state"
key = "project-key"
}
}
Choose account alias
If you want the URL for your sign-in page to contain your company name or other friendly identifier instead of your AWS account ID, you can create an account alias.
resource "aws_iam_account_alias" "alias" {
account_alias = "my-account-alias"
}
Example sign-in page for account
Best Practices for Terraform on AWS
Terraform’s integration with AWS provides a powerful, scalable solution for managing infrastructure. Here are some key benefits:
- Automation and Efficiency: By automating infrastructure provisioning, Terraform reduces manual work and errors.
- Scalability: Scaling your infrastructure up or down based on demand is straightforward.
- Version Control: Using IaC, you can track changes and revert to previous states if necessary.
To get started, you’ll need to set up credentials so Terraform can access your AWS account to create, update, and delete resources.
Log in to your AWS Management Console.
Go to Identity and Access Management.
Create a new IAM user with programmatic access, which will give you an access key ID and a secret access key.
Pro Tip: Store your credentials securely
When provisioning via AFT, the workflow is separated across repositories to maintain separation of duties and auditability. Account requests are decoupled from provisioning customizations and global customizations.
Conclusion
Creating an AWS account with Terraform is not a single operation but a layered workflow. For standalone accounts, the foundation is a properly scoped IAM service user with programmatic access keys, a configured AWS provider with a named profile and region, and a remote S3 backend with versioning, encryption, and private ACLs to protect state. For governed environments, AWS Control Tower Account Factory for Terraform provides a GitOps driven pipeline that automates account creation and post-provisioning customization while enforcing organizational security guidelines.
The AFT model separates concerns into four repositories: account request handling, provisioning customizations, account level customizations, and global customizations. Account requests are submitted via Terraform commits to the aft-account-request repository, which triggers CodePipeline and Step Functions workflows that ultimately invoke Account Factory and then apply Terraform customizations. Custom fields flow from the account request into Systems Manager Parameter Store in the vended account, enabling parameterized configurations.
Using a dedicated Terraform IAM user with AdministratorAccess for initial setup, and keeping access keys safe and secure, ensures that Terraform can authenticate without using root credentials. Remote state in S3 with versioning and server-side encryption AES256 protects the state file and supports collaboration. Account alias resources provide a friendly sign-in URL.
Together, these patterns enable repeatable, auditable, and customizable AWS account creation whether provisioning one standalone account or hundreds of governed accounts via Control Tower.