AWS Control Tower AFT re-applies customizations on account OU move

AWS Control Tower Account Factory for Terraform (AFT) can now automatically re-apply an account's customizations when it moves to a different Organizational Unit (OU). This addresses the previous requirement for manual triggering, mitigating configuration drift and operational overhead. To enable this, set `aft_customization_triggers = ["account_move"]` in your AFT configuration.

The re-application workflow for customizations on account OU moves is optimized to skip the bootstrap and provisioning phases. It only runs global and account-level customizations, leading to faster execution. Individual accounts can be excluded from this automated re-application by setting `account_skip_customization_triggers = "true"`.

This release includes support for custom Terraform Cloud and Enterprise workspace naming variables, tighter access controls on the AFT logging bucket, and improved scaling for large-scale AWS Enterprise Support enrollment. These enhancements benefit organizations enforcing compliance or security baselines tied to OU membership.

The automatic customization re-application capability is available today across all AWS regions where AWS Control Tower Account Factory for Terraform is offered. Further details on enabling this feature and upgrading can be found in the AFT documentation and on GitHub.