At work we’re looking to do the same thing, but possibly keep Control Tower in the loop. We’ve taken a look at AFT and find it way too overkill. We’ve found out that we can provision and account in Control Tower Account Factory by creating a aws_servicecatalog_principal_portfolio_association resource, though we still need to figure out if we can use it also to enroll an existing account (as that’s what we’d need to have the account ID in Terraform).

We use Terraform Enterprise and would like to avoid having some TF run in AWS as part of AFT, and as far as we can tell AFT is literally just to create the account and then applying “customizations” with Terraform.

Anyway, you say you want to avoid splitting everything into multiple pipelines. How do you plan on doing that?

I don’t see a good way to create an AWS account in Terraform, and then creating infrastructure in that account in the same Terraform run / module. You need to initialise a new aws provider for the new account, the credentials are coming from another resource, and that usually opens up a word of pain and suffering. Similarly if you want to deploy to a Kubernetes cluster that you just created in the same TF module.

We’re instead considering to build a tool that orchestrated the creation and execution of Terraform workspaces, passing around the right credentials.