• AFT can now re-apply an account's customizations when the account is moved to a different organizational unit (OU). Previously, moving an enrolled account between OUs did not re-apply its customizations. Now, you can opt in to automatic re-application by setting aft_customization_triggers = ["account_move"] in your AFT deployment.
  • Note: When AFT re-applies customizations from a trigger, it skips the account provisioning (bootstrap) phase and runs only your global and account customizations to improve performance (see below).
  • Note: This behavior applies to all AFT managed accounts. To exclude a specific account after enabling this feature, set account_skip_customization_triggers = "true" on that account's request file in the aft-account-request repository.
• AFT can now bypass the account provisioning (bootstrap) phase on demand, outside of a trigger, by passing "bypass_steps": ["provisioning_bootstrap"] in the input when you start the customizations (aft-invoke-customizations) state machine. AFT then runs only your global and account customizations.
  • Note: The bootstrap phase is what creates and repairs an account's AFT resources, including its account customization pipeline. If you bypass the bootstrap on an account whose AFT resources have been deleted or modified, the customizations run can fail, because AFT does not recreate those resources during a bypassed run. Only pass bypass_steps when the account's AFT resources are known to be intact.
• AFT now supports custom Terraform Cloud/Enterprise workspace names for the account request and account provisioning customizations operations, through the new account_request_workspace_name and account_provisioning_customizations_workspace_name variables. (#613)
  • Note: Changing a workspace name on an existing deployment creates a new workspace and orphans the old one; it is not an in-place rename.
• Strengthen protection of your AFT logs by ensuring the AFT logging bucket and its encryption key only allow access from accounts within your AWS organization.
• Improve how AFT scales when enrolling large numbers of accounts in Enterprise Support concurrently. AFT now caches each account's enrollment status. (#595, #523)
• Migrate to reading Account State field in AWS Organizations API responses (#627)
• Bugfix: Fix an issue where upgrading AFT could leave the Lambda layer out of sync with the function code, causing account provisioning to fail with a Python import error. (#625, #520)
• Bugfix: Fix an issue where a fresh AFT deployment could intermittently fail while enabling access logging on its S3 buckets.