Security practices for customizing multiple environments
summary
Three customization paths exist with concrete tradeoffs: Account Factory Customizations is a managed Control Tower feature that uses Service Catalog blueprints (now supporting Terraform via a hub engine) to apply blueprints during provisioning and removes pipeline upkeep, with partner blueprints (11 at launch) available; CloudFormation StackSets via CfCT uses pipeline-triggered StackSets, EventBridge lifecycle events, Step Functions and SQS for orchestration but runs in the management account; AFT is a Terraform-based vending+customization pipeline with delegated admin and DynamoDB state but more moving parts. Control Tower reports 400 managed controls and customers operate up to 14,000 accounts.
AI-written summary · about
chapters (11)
- 0:00Introduction and Why
- 4:20AWS Control Tower Overview
- 7:34Landing Zone and Scale
- 10:41Customization Frameworks
- 13:00CloudFormation StackSets
- 23:20CFCT Pipeline Approach
- 27:56Terraform Framework (AFT)
- 33:55AFC Managed Feature
- 39:51Terraform Support in AFC
- 43:57AFC Demo
- 55:36Choosing the Right Approach
related talks
28mStay in Control While Moving Fast
40mCreating a managed, governed, and secure SaaS foundation on
28mSecure cloud migration environments built with Control Tower &
32mBuilding an Enterprise Grade Multi Account AWS Environment
25mHow Toyota scaled cloud onboarding with HCP Terraform and AFT
47mManage AWS Cloud Environments Easily and Securely
55mBest practices
22mLaunch Control - Automating a Security Baseline...