• Feature: AFT can now vend accounts without AWS Service Catalog. Set account_vending_method = "organizations" to have AFT create accounts with the AWS Organizations CreateAccount API and move them into their target OU, where Control Tower enrolls them through account auto-enrollment. Use this method in home Regions where Service Catalog isn't available. The default, service_catalog, keeps the existing behavior.
  • Note: This method requires landing zone version 3.1 or later with auto-enrollment turned on, and target OUs must be registered with Control Tower.
  • Note: AFT doesn't use SSOUserEmail, SSOUserFirstName, or SSOUserLastName with this method.
  • Note: Unlike Account Factory, this method doesn't delete the account's default VPCs. To delete them, set aft_feature_delete_vended_account_default_vpcs_enabled = true.
• Feature: When you use the organizations vending method, AFT checks that each account has the baselines and controls enabled on its OU before it runs customizations. By default (governance_validation_mode = "warn"), AFT publishes any gaps to the aft-notifications SNS topic. Set governance_validation_mode = "fail" to fail the account request instead. To turn off the check, set aft_feature_governance_validation = false.
• Dependencies: Updated black, urllib3, virtualenv, and filelock.