• AFT can now perform a plan-only (read-only) run of your customizations, so you can preview the Terraform changes an account would receive without applying them. Previously, invoking customizations always ran a full apply. To trigger a plan-only run, pass "plan_only": true in the input when you start the customizations state machine (aft-invoke-customizations). AFT then runs terraform plan for your global and account customizations instead of terraform apply. This works across all supported Terraform distributions (open source, Terraform Cloud, and Terraform Enterprise).
• On the Terraform Cloud/Enterprise path, AFT can optionally export each plan's JSON output to a dedicated, encrypted plan-output S3 bucket in the AFT management account. The bucket is encrypted with the AFT KMS key, is versioned, blocks public access, and limits writes to the AFT customizations build role. Export is off by default; to enable it, set aft_plan_output_export_enabled = true in your AFT deployment. When export is disabled, plan results remain viewable in the HCP Terraform run UI. Exported plans are retained for 30 days by default. To change this duration, use the new aft_plan_output_retention_days variable.
• Bugfix: Fix an issue where account provisioning could fail in split-stage pipelines (where terraform plan and terraform apply run on separate filesystems) because the Lambda deployment archives generated at plan time were missing at apply time. (#633)
• Bugfix: Fix an issue where a fresh AFT deployment could fail to configure replication on its Terraform state backend buckets because replication was configured before bucket versioning was enabled.