AWS Control Tower provides a pre-configured landing zone for multi-account AWS environments built on AWS Organizations, Service Catalog, and Config. Terraform can manage landing zones and the ongoing configuration of organizational units, account provisioning, guardrails, and customizations. The integration is centered on Account Factory for Terraform, a GitOps-driven pipeline that provisions accounts with Control Tower governance while allowing Terraform-based customization. This article covers the components, deployment steps, workflow, and operational boundaries for using Terraform with AWS Control Tower.
Understanding AWS Control Tower Core Components
Control Tower automates the setup and governance of a multi-account AWS environment. It builds on AWS Organizations, Service Catalog, and Config to give a pre-configured landing zone with guardrails that enforce security and compliance policies.
The core components that Terraform interacts with are:
- Landing Zone: The overall multi-account environment structure
- Organizational Units: Groups of accounts with shared policies
- Guardrails: Preventive and detective controls implemented as SCPs and Config rules
- Account Factory: Automated account provisioning
- Log Archive Account: Centralized logging
- Audit Account: Security and compliance auditing
| Component | Role in Landing Zone |
|---|---|
| Management Account | Root control plane for Organizations |
| Security OU | Contains Log Archive Account and Audit Account |
| Sandbox OU | Contains Developer Sandbox Accounts |
| Workloads OU | Contains Production Account and Staging Account |
A typical hierarchy shows the Management Account connecting to Security OU, Sandbox OU, and Workloads OU. The Security OU contains the Log Archive Account and Audit Account. The Sandbox OU contains Developer Sandbox Accounts. The Workloads OU contains Production Account and Staging Account.
Account Factory for Terraform Overview
AWS Control Tower Account Factory for Terraform is a Terraform module that makes it easy to create and customize new accounts that comply with your organization's security guidelines. AFT defines a pipeline for automated and consistent creation of AWS Control Tower accounts, giving you the benefits of Terraform's workflow and Control Tower's governance features. AWS maintains this module.
Account Factory for Terraform sets up a Terraform pipeline to help you provision and customize accounts in AWS Control Tower. AFT provides the advantage of Terraform-based account provisioning while allowing you to govern your accounts with AWS Control Tower.
With AFT you create an account request Terraform file to get the input that triggers the AFT workflow for account provisioning. After the account provisioning stage is complete, AFT automatically runs a series of steps before the account customizations stage begins.
AFT follows a GitOps model to automate the processes of account provisioning and account updating in AWS Control Tower. You'll create an account request Terraform file, which provides the necessary input that triggers the AFT workflow for account provisioning.
AFT supports HCP Terraform, Terraform Enterprise, and Terraform Community Edition. With AFT you can initiate account creation using an input file and a simple git push command and customize new or existing accounts. Account creation includes all of the AWS Control Tower governance benefits and account customizations that help you meet your organization's standard security procedures and compliance guidelines.
AFT supports account customization request tracing. Every time you submit an account customization request, AFT generates a unique tracing token that passes through an AFT customizations AWS Step Functions state machine, which logs the token as part of its execution. You can then use Amazon CloudWatch Logs insights queries to search timestamp ranges and retrieve the request token.
Prerequisites and One-Time Deployment
The tutorial guides you through the one-time steps required to deploy AFT to create the pipeline for account creation. Then, you will use AFT to create and customize your Control Tower accounts. In this tutorial, you will deploy the AFT module, review the support account customization options, and learn about the components of AFT and its workflow.
This tutorial assumes that you are familiar with the standard Terraform workflow. If you are new to Terraform, complete the Get Started tutorials first.
For this tutorial, you will need:
- Terraform v0.15+ installed locally configured with credentials for the non-root user with AdministratorAccess
- an AWS account, with credentials for a non-root user with the AdministratorAccess policy attached
- Some steps can take up to 30 minutes, so make sure your credentials have a long enough duration
Five steps are required to configure and launch your AFT environment.
Step 1: Launch your AWS Control Tower landing zone
Before launching AFT, you must have a working AWS Control Tower landing zone in your AWS account. You will configure and launch AFT from the AWS Control Tower management account.
Step 2: Create a new organizational unit for AFT
We recommend that you create a separate OU in your AWS Organization, where you will deploy the AFT management account. Create an OU through your AWS Control Tower management account.
The examples assume you already have a Control Tower landing zone.
Product versions for control management:
| Item | Version |
|---|---|
| AWS Control Tower | 3.2 or later |
| Terraform | 1.5 or later |
| Terraform AWS Provider | 4.67 or later |
AFT Workflow and Pipeline Stages
Deploying AFT requires a dedicated AFT management account. This setup is optimally managed via the Account Factory for Terraform, which automates state backend provisioning and isolates deployment pipelines utilizing secure cross-account execution roles.
Integrating infrastructure-as-code within an AWS Control Tower ecosystem requires a clear delineation of responsibilities between the management account and baseline child accounts. Control Tower orchestrates the organizational structure, applying Service Control Policies and AWS Config rules across Organizational Units. Terraform operates within these boundaries, deploying specific application architectures, networking primitives, and IAM sub-roles.
Before executing any local infrastructure code, you must design a deployment architecture that respects the security boundaries enforced by Control Tower. In a typical landing zone setup, the AWS Organizations root consists of a Management account, a Log Archive account, an Audit account, and various workload-specific OUs such as Development, Staging, and Production. Terraform should never run directly from the Management account for day-to-day resource delivery.
The account request file provides the necessary input that triggers the AFT workflow for account provisioning. The pipeline stages are:
- Account provisioning stage
- Automated intermediate steps
- Account customizations stage
Integrating Terraform with Control Tower Controls
Deploy and manage AWS Control Tower controls by using Terraform to implement and administer preventive, detective, and proactive security controls. A control, also known as a guardrail, is a high-level rule that provides ongoing governance for your overall AWS Control Tower environment.
AWS Control Tower helps you implement preventive, detective, and proactive controls that govern your AWS resources and monitor compliance across multiple AWS accounts. Each control enforces a single rule. In this pattern, you use a provided IaC template to specify which controls you want to deploy in your environment.
AWS Control Tower controls apply to an entire organizational unit, and the control affects every AWS account within the OU. Therefore, when users perform any action in any account in your landing zone, the action is subject to the controls that govern the OU.
Implementing AWS Control Tower controls helps establish a strong security foundation for your AWS landing zone.
Control behavior types:
| Behavior | Implementation | Status |
|---|---|---|
| Preventive controls | Service Control Policies or Resource Control Policies in AWS Organizations | Enforced or not enabled |
| Detective controls | AWS Config rules | |
| Proactive controls |
For AWS Control Tower controls, this pattern requires the use of global identifiers that are in the following format:
arn:<PARTITION>:controlcatalog:::control/<CONTROL_CATALOG_OPAQUE_ID>
Previous versions of this pattern used regional identifiers that are no longer supported. We recommend that you migrate from Regional identifiers to global identifiers. Global identifiers help you manage controls and expand the number of controls that you can use.
In most cases, the value for
Architecture and Account Structure
While many teams still perform Control Tower's initial setup through the console, Terraform can manage landing zones and the ongoing configuration - organizational units, account provisioning, guardrails, and customizations.
The multi-account core architecture respects security boundaries enforced by Control Tower. The Management account remains the control plane. Child accounts receive governance via SCPs and Config rules applied at the OU level.
A typical Terraform integration uses:
- Management account for AFT pipeline deployment
- AFT management account in a dedicated OU
- Log Archive account for centralized logging
- Audit account for security and compliance auditing
- Workload OUs for Development, Staging, Production
Best Practices and Limitations
Terraform should never run directly from the Management account for day-to-day resource delivery. Keep the Management account isolated for organization-level governance.
Use GitOps for AFT requests. Account creation can be initiated using an input file and a simple git push command. This provides auditability and repeatability.
Use account customization request tracing for operational visibility. Every customization request generates a unique tracing token that passes through an AFT customizations AWS Step Functions state machine.
Limitations for control management:
- Terraform AWS Provider must be configured
- Terraform backend must be configured
- Controls require global identifiers in the format arn:
:controlcatalog:::control/
Conclusion
AWS Control Tower Terraform integration delivers consistent, auditable multi-account governance with infrastructure as code flexibility. Account Factory for Terraform provides a GitOps pipeline for provisioning and customizing accounts under Control Tower guardrails, while Terraform controls enable declarative management of preventive, detective, and proactive controls across organizational units. The operational model separates the Management account, AFT management account, Log Archive and Audit accounts, and workload OUs, with Terraform executing within those boundaries via secure cross-account roles. Maintaining a dedicated AFT OU, using global control identifiers, and preserving tracing tokens for customization requests supports a scalable landing zone that enforces security and compliance without sacrificing developer velocity.