SAP-C02 Practice Question 13: Control Tower Account Factory Terraform
AWS Certified Solutions Architect – Professional (SAP-C02) · Test 2 · question 3 of 10
A software company already runs an AWS Control Tower landing zone. Its platform engineering team standardized on Terraform years ago and has no CloudFormation skills. The team now receives about 15 requests a week for new AWS accounts.
The team wants the following. A new account is requested by committing a file to a Git repository and merging a pull request. Every new account is enrolled in Control Tower so that the landing zone's controls apply to it. After creation, the pipeline applies the company's Terraform baseline to the account (a standard VPC, IAM roles, and logging settings), and different baselines can target all accounts, a group of accounts, or a single account. Every request is traceable afterwards.
Which solution meets these requirements with the least custom code?
Show answer and explanation
Answer:
Account Factory for Terraform (AFT) was built for this exact scenario. It sets up a Terraform pipeline, run from a dedicated AFT management account, that provisions accounts through AWS Control Tower Account Factory. Every account it creates is therefore enrolled and governed by the landing zone. Requests follow a GitOps model: an account request Terraform file is committed and pushed, and that triggers provisioning. After provisioning, AFT runs customization stages that can target all accounts, a set of accounts, or individual accounts. It stores account metadata and audit history, and tracing tokens let each customization request be followed through the workflow. It supports HCP Terraform, Terraform Enterprise, and Terraform Community Edition, with CodeCommit or other Git providers through AWS CodeConnections. The team writes Terraform and little else.
Option A rebuilds AFT by hand, and gets it wrong. An account created directly with the Organizations API is not enrolled in Control Tower, so landing zone controls and baselines don't apply until someone enrolls it separately. The Lambda, pipeline, state handling, and audit trail are all custom code the team would own.
Option B is a legitimate Control Tower customization framework, but it is CloudFormation-based. CfCT deploys CloudFormation templates and SCPs from a manifest, which conflicts with a Terraform-only team. CfCT customizes accounts but doesn't take Git-based account *requests* the way AFT does.
Option D is manual. Creating accounts by hand in the console for 15 requests a week defeats the Git-driven request flow. StackSets are CloudFormation again, and they offer no per-request audit trail.
Reference: Overview of AWS Control Tower Account Factory for Terraform (AFT)