build(deps): bump aws-ia/control_tower_account_factory/aws from 1.20.1 to 1.21.1 in /terraform

[dependabot]

Bumps aws-ia/control_tower_account_factory/aws from 1.20.1 to 1.21.1.

Release notes

Sourced from aws-ia/control_tower_account_factory/aws's releases.

1.21.1

• Restore repository README and clarify account_move customization trigger behavior

1.21.0

• AFT can now re-apply an account's customizations when the account is moved to a different organizational unit (OU). Previously, moving an enrolled account between OUs did not re-apply its customizations. Now, you can opt in to automatic re-application by setting aft_customization_triggers = ["account_move"] in your AFT deployment.
  • Note: When AFT re-applies customizations from a trigger, it skips the account provisioning (bootstrap) phase and runs only your global and account customizations to improve performance (see below).
  • Note: This behavior applies to all AFT managed accounts. To exclude a specific account after enabling this feature, set account_skip_customization_triggers = "true" on that account's request file in the aft-account-request repository.
• AFT can now bypass the account provisioning (bootstrap) phase on demand, outside of a trigger, by passing "bypass_steps": ["provisioning_bootstrap"] in the input when you start the customizations (aft-invoke-customizations) state machine. AFT then runs only your global and account customizations.
  • Note: The bootstrap phase is what creates and repairs an account's AFT resources, including its account customization pipeline. If you bypass the bootstrap on an account whose AFT resources have been deleted or modified, the customizations run can fail, because AFT does not recreate those resources during a bypassed run. Only pass bypass_steps when the account's AFT resources are known to be intact.
• AFT now supports custom Terraform Cloud/Enterprise workspace names for the account request and account provisioning customizations operations, through the new account_request_workspace_name and account_provisioning_customizations_workspace_name variables. (#613)
  • Note: Changing a workspace name on an existing deployment creates a new workspace and orphans the old one; it is not an in-place rename.
• Strengthen protection of your AFT logs by ensuring the AFT logging bucket and its encryption key only allow access from accounts within your AWS organization.
• Improve how AFT scales when enrolling large numbers of accounts in Enterprise Support concurrently. AFT now caches each account's enrollment status. (#595, #523)
• Migrate to reading Account State field in AWS Organizations API responses (#627)
• Bugfix: Fix an issue where upgrading AFT could leave the Lambda layer out of sync with the function code, causing account provisioning to fail with a Python import error. (#625, #520)
• Bugfix: Fix an issue where a fresh AFT deployment could intermittently fail while enabling access logging on its S3 buckets.

Commits

• defc044 Release: 1.21.1
• 43f0c92 Release: 1.21.0
• See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)