Provision and update accounts using automation (original) (raw)

You can provision or update individual accounts in AWS Control Tower by several methods:

• You can provision and customize accounts with AWS Control Tower Account Factory for Terraform (AFT). For more information, see Overview of AWS Control Tower Account Factory for Terraform (AFT).
• You can update accounts with Customizations for AWS Control Tower (CfCT). For more information, see Customizations for AWS Control Tower (CfCT) overview .
• Script automation: If you prefer to use an API approach, you can update accounts using the API framework of Service Catalog and the AWS CLI to update the accounts in a batch process. You'd call the UpdateProvisionedProduct API of Service Catalog for each account. You can write a script to update the accounts, one by one, with this API. More information about this approach, when adding Regions for governance, is available in a blog post, Enabling guardrails in new AWS Regions.
  You can update as many as five (5) accounts at a time. You must wait for at least one account update to succeed before beginning the next account update. Therefore, the process may take a long time if you have a lot of accounts, but it is not complicated. For more information about this approach, see the Walkthrough: Automate Account Provisioning in AWS Control Tower by Service Catalog APIs.

Video walkthrough

The Video Walkthrough is designed for automated account provisioning with a script, but the steps also apply to account updating. Use theUpdateProvisionedProduct API instead of the ProvisionProduct API.

A further step of automation by script is to check for Succeed status of the AWS Control Tower UpdateLandingZone lifecycle event. Use it as a trigger to begin updating individual accounts as described in the video. A lifecycle event marks the completion of a sequence of activities, so the occurrence of this event means that a landing zone update is complete. The landing zone update must be complete before account updates begin. For more information about working with lifecycle events, see Lifecycle Events.

Resolve drift with Reset and Re-register

Automate tasks

Did this page help you? - Yes

Thanks for letting us know we're doing a good job!

If you've got a moment, please tell us what we did right so we can do more of it.

Did this page help you? - No

Thanks for letting us know this page needs work. We're sorry we let you down.

If you've got a moment, please tell us how we can make the documentation better.