terraform-aws-control_tower_account_factory VS aws-control-tower-customizations

Repos-AFT

I have raise the issue in here, you can check it out. https://github.com/aws-ia/terraform-aws-control_tower_account_factory/issues/393

We're separating terraform infra gitops repo and application gitops repo with argo and Crossplane by setting the respective IRSA security boundaries for AWS EKS using custom Control Tower AFT deployment and sharing the respective cross-account resources with AWS RAM, so every developer gets it's own isolated EKS cluster inside an isolated account - there's no IAM Role per Developer nonsense.

Account Factory for Terraform

Control Tower Account Factory For Terraform — Setting up an AWS organisation isn’t easy, and when you try doing that with Terraform, it’s not any easier! You need to decide on things like patterns for your backend / state management (e.g. how many backend locations you want, and which AWS accounts those backends will live), and you’ll need to hand-roll a load of tooling to get things to work. This new module is kinda AWS out-of-the-box in a Terraform module. However… the code module behind the announcement only has only two contributors 👀. That said, it is nice to see AWS supporting Terraform more heavily. Earlier this year, AWS announced they would invest in officially supported Terraform modules [1][2], which now live under a new GitHub organisation called “AWS Integration & Automation” [1]. The terraform modules announcement did come with some criticisms, though about the lack of engagement with existing open source folks before announcing the project [1].

For my landing zone I used the Customizations for AWS Control Tower (CfCt) project. When I created my landing zone the Landing Zone Accelerator was not yet available. I still need to evaluate if I can switch, but my initial concerns are the cost of running it. CfCt has low costs and depending on your usage it might even fit in the free tier. The Landing Zone Accelerator comes with VPCs and transit gateways and some other services that will generate costs regardless of what you are doing with the landing zone.

The team at AWS that have developed the SRA utilised Customisations for Control Tower (CfCT) as the delivery mechanism for there customisations but since they don't maintain that solution itself, it's strongly recommended to check the current version of CfCT here prior to launching the CloudFormation Template.