• Includes support for customizing Control Tower Shared Accounts (Log Archive, Audit), and the Organization Management Account.
• AFT now uses an AWSAFTService role to deploy AFT resources, which is deployed in all managed accounts. The existing AWSAFTExecution role is now used for deploying customizations only. You can use IAM permissions boundaries to limit the permissions of the AWSAFTExecution role to match the permission requirements of your customizations, and limit their access to managed accounts.