Comparing the options for AWS account customizations

When setting up new AWS accounts in your organization, there's often a need to create compute resources, establish network connectivity, or implement other standardized configurations. This can be accomplished in various ways, and choosing the right approach can significantly impact your operational efficiency and governance posture. Some options are better suited to certain types of organizations than others. Let's examine the three main account customization options available to organizations running a Control Tower landing zone and help you determine which approach fits your needs.

Option 1: Account Factory Customizations (AFC)

Overview

Account Factory Customizations (AFC) is the most basic approach to account customization, built directly into the AWS console on the Control Tower account factory page.

Key Features

• Console-based deployment through Control Tower interface
• Integration with Service Catalog blueprints
• Support for CloudFormation templates and external products (e.g., Terraform open source)
• Single-click customization selection and deployment

Best For

• Smaller organizations with basic customization needs
• Teams preferring GUI-driven workflows
• Organizations getting started with account customizations
• Simple, single-stack resource deployments

Limitations

• Limited to single Service Catalog blueprint per account
• Console-only interface (no CLI or API automation)
• Not suitable for complex multi-stack requirements
• Less flexibility for advanced customization scenarios

Option 2: Customizations for AWS Control Tower (CfCT)

Overview

Customizations for AWS Control Tower (CfCT) allows for more fine-grained customizations through automated deployment across your organization.

Key Features

• Multi-stack resource deployments
• Targeting of specific accounts and organizational units
• Service control policies (SCPs) management
• Automated deployment via CloudFormation StackSets
• Integration with Control Tower lifecycle events

Best For

• Larger organizations with advanced customization needs
• Teams requiring automation over console-driven workflows
• Complex multi-stack resource requirements
• Organizations needing OU-level policy management

Limitations

• More complex setup and configuration
• Requires CloudFormation expertise
• Higher operational overhead for maintenance
• Not ideal for simple, single-stack deployments

Option 3: Account Factory for Terraform (AFT)

Overview

Account Factory for Terraform (AFT) enables both creation and customization of AWS accounts using a Terraform-based pipeline approach.

Key Features

• Full Terraform pipeline integration
• Infrastructure-as-code (IaC) consistency across account management
• Advanced automation capabilities
• Git-based workflow for customization management
• Support for complex, multi-resource deployments

Best For

• Organizations standardized on Terraform
• Teams seeking full IaC consistency
• Advanced automation requirements
• Larger organizations with complex infrastructure needs

Limitations

• Requires Terraform expertise and pipeline management
• More complex initial setup and configuration
• Higher learning curve for teams new to Terraform
• Additional infrastructure overhead for pipeline management

Conclusion

This comparison outlines some of the key differences in your AWS account customization options in a Control Tower organization. When making your decision, consider these key factors:

• Organization size and complexity: Smaller teams may benefit from AFC's simplicity, while larger organizations typically look for CfCT or AFT's advanced capabilities
• Deployment complexity: AFC offers the simplest deployment experience through the console, while CfCT and AFT require more complex setup and pipeline management
• Automation requirements: If you need programmatic account creation and management, CfCT or AFT are better choices than the console-based AFC
• Existing tooling: Organizations already using Terraform should strongly consider AFT for consistency

Next Steps

Ready to get started? Here are your next steps:

1. For AFC: Navigate to the Control Tower console and explore the Account Factory Customizations section
2. For CfCT: Review the CfCT deployment guide and prepare your customization templates
3. For AFT: Check the AFT prerequisites and set up your Terraform pipeline

As an added note, if your organization is in a highly regulated industry and you're looking for an all-inclusive way to manage your landing zone configuration, check out our Landing Zone Accelerator (LZA) solution!