Release: 1.11.0

.coveragerc

@@ -0,0 +1,13 @@
+# Copyright Amazon.com, Inc. or its affiliates. All rights reserved.
+# SPDX-License-Identifier: Apache-2.0
+#
+[run]
+branch = True
+omit = tests/*
+
+[report]
+show_missing = True
+precision = 1
+exclude_lines =
+    # Required due to conditional mypy imports
+    if TYPE_CHECKING: 

.gitignore

@@ -226,6 +226,9 @@ override.tf.json
 .terraformrc
 terraform.rc
 
+# Always ignore layer build directories
+sources/aft-lambda-layer/build
+
 ### Windows ###
 # Windows thumbnail cache files
 Thumbs.db

PYTHON_VERSION

@@ -0,0 +1 @@
+3.11

README.md

@@ -63,14 +63,14 @@ As of version 1.6.0, AFT collects anonymous operational metrics to help AWS impr
 
 | Name | Version |
 |------|---------|
-| <a name="requirement_terraform"></a> [terraform](#requirement\_terraform) | >= 0.15.1, < 2.0.0 |
-| <a name="requirement_aws"></a> [aws](#requirement\_aws) | >= 4.27.0, < 5.0.0 |
+| <a name="requirement_terraform"></a> [terraform](#requirement\_terraform) | >= 1.0.0, < 2.0.0 |
+| <a name="requirement_aws"></a> [aws](#requirement\_aws) | >= 5.11.0, < 6.0.0 |
 
 ## Providers
 
 | Name | Version |
 |------|---------|
-| <a name="provider_aws"></a> [aws](#provider\_aws) | >= 4.27.0, < 5.0.0 |
+| <a name="provider_aws"></a> [aws](#provider\_aws) | >= 5.11.0, < 6.0.0 |
 | <a name="provider_local"></a> [local](#provider\_local) | n/a |
 
 ## Modules
@@ -93,6 +93,7 @@ As of version 1.6.0, AFT collects anonymous operational metrics to help AWS impr
 | Name | Type |
 |------|------|
 | [aws_partition.current](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/partition) | data source |
+| [local_file.python_version](https://registry.terraform.io/providers/hashicorp/local/latest/docs/data-sources/file) | data source |
 | [local_file.version](https://registry.terraform.io/providers/hashicorp/local/latest/docs/data-sources/file) | data source |
 
 ## Inputs
@@ -133,7 +134,7 @@ As of version 1.6.0, AFT collects anonymous operational metrics to help AWS impr
 | <a name="input_terraform_distribution"></a> [terraform\_distribution](#input\_terraform\_distribution) | Terraform distribution being used for AFT - valid values are oss, tfc, or tfe | `string` | `"oss"` | no |
 | <a name="input_terraform_org_name"></a> [terraform\_org\_name](#input\_terraform\_org\_name) | Organization name for Terraform Cloud or Enterprise | `string` | `"null"` | no |
 | <a name="input_terraform_token"></a> [terraform\_token](#input\_terraform\_token) | Terraform token for Cloud or Enterprise | `string` | `"null"` | no |
-| <a name="input_terraform_version"></a> [terraform\_version](#input\_terraform\_version) | Terraform version being used for AFT | `string` | `"0.15.5"` | no |
+| <a name="input_terraform_version"></a> [terraform\_version](#input\_terraform\_version) | Terraform version being used for AFT | `string` | `"1.5.7"` | no |
 | <a name="input_tf_backend_secondary_region"></a> [tf\_backend\_secondary\_region](#input\_tf\_backend\_secondary\_region) | AFT creates a backend for state tracking for its own state as well as OSS cases. The backend's primary region is the same as the AFT region, but this defines the secondary region to replicate to. | `string` | `""` | no |
 | <a name="input_vcs_provider"></a> [vcs\_provider](#input\_vcs\_provider) | Customer VCS Provider - valid inputs are codecommit, bitbucket, github, or githubenterprise | `string` | `"codecommit"` | no |
 

VERSION

@@ -1 +1 @@
-1.10.4
+1.11.0

data.tf

@@ -5,4 +5,8 @@ data "local_file" "version" {
   filename = "${path.module}/VERSION"
 }
 
+data "local_file" "python_version" {
+  filename = "${path.module}/PYTHON_VERSION"
+}
+
 data "aws_partition" "current" {}

examples/multiple-account-customizations/account-customization-dev/terraform/backend.jinja

@@ -3,7 +3,7 @@
 
 {% if tf_distribution_type == "oss" -%}
 terraform {
-  required_version = ">= 0.15.1"
+  required_version = ">= {{ tf_version }}"
   backend "s3" {
     region         = "{{ region }}"
     bucket         = "{{ bucket }}"

examples/multiple-account-customizations/account-customization-prod/terraform/backend.jinja

@@ -3,7 +3,7 @@
 
 {% if tf_distribution_type == "oss" -%}
 terraform {
-  required_version = ">= 0.15.1"
+  required_version = ">= {{ tf_version }}"
   backend "s3" {
     region         = "{{ region }}"
     bucket         = "{{ bucket }}"

examples/multiple-regions-customization/multiple-regions/terraform/backend.jinja

@@ -3,7 +3,7 @@
 
 {% if tf_distribution_type == "oss" -%}
 terraform {
-  required_version = ">= 0.15.1"
+  required_version = ">= {{ tf_version }}"
   backend "s3" {
     region         = "{{ region }}"
     bucket         = "{{ bucket }}"

locals.tf

@@ -16,7 +16,8 @@ locals {
   log_archive_access_logs_bucket_name              = "aws-aft-s3-access-logs"
   log_archive_bucket_object_expiration_days        = "365"
   lambda_layer_codebuild_delay                     = "420s"
-  lambda_layer_python_version                      = "3.9"
+  lambda_layer_python_version                      = chomp(trimspace(data.local_file.python_version.content))
+  lambda_runtime_python_version                    = format("%s%s", "python", chomp(trimspace(data.local_file.python_version.content)))
   lambda_layer_name                                = "aft-common"
   create_role_lambda_function_name                 = "aft-account-provisioning-framework-create-aft-execution-role"
   tag_account_lambda_function_name                 = "aft-account-provisioning-framework-tag-account"

main.tf

@@ -30,7 +30,7 @@ module "aft_account_provisioning_framework" {
   delete_default_vpc_lambda_function_name          = local.delete_default_vpc_lambda_function_name
   enroll_support_lambda_function_name              = local.enroll_support_lambda_function_name
   enable_cloudtrail_lambda_function_name           = local.enable_cloudtrail_lambda_function_name
-
+  lambda_runtime_python_version                    = local.lambda_runtime_python_version
 }
 
 module "aft_account_request_framework" {
@@ -52,6 +52,7 @@ module "aft_account_request_framework" {
   concurrent_account_factory_actions          = var.concurrent_account_factory_actions
   request_framework_archive_path              = module.packaging.request_framework_archive_path
   request_framework_archive_hash              = module.packaging.request_framework_archive_hash
+  lambda_runtime_python_version               = local.lambda_runtime_python_version
 }
 
 
@@ -128,6 +129,7 @@ module "aft_customizations" {
   customizations_archive_path                       = module.packaging.customizations_archive_path
   customizations_archive_hash                       = module.packaging.customizations_archive_hash
   global_codebuild_timeout                          = var.global_codebuild_timeout
+  lambda_runtime_python_version                     = local.lambda_runtime_python_version
 }
 
 module "aft_feature_options" {
@@ -156,6 +158,7 @@ module "aft_feature_options" {
   delete_default_vpc_lambda_function_name   = local.delete_default_vpc_lambda_function_name
   enroll_support_lambda_function_name       = local.enroll_support_lambda_function_name
   enable_cloudtrail_lambda_function_name    = local.enable_cloudtrail_lambda_function_name
+  lambda_runtime_python_version             = local.lambda_runtime_python_version
 }
 
 module "aft_iam_roles" {
@@ -177,6 +180,7 @@ module "aft_lambda_layer" {
   lambda_layer_name                                 = local.lambda_layer_name
   lambda_layer_codebuild_delay                      = local.lambda_layer_codebuild_delay
   lambda_layer_python_version                       = local.lambda_layer_python_version
+  lambda_runtime_python_version                     = local.lambda_runtime_python_version
   aft_tf_aws_customizations_module_git_ref_ssm_path = local.ssm_paths.aft_tf_aws_customizations_module_git_ref_ssm_path
   aft_tf_aws_customizations_module_url_ssm_path     = local.ssm_paths.aft_tf_aws_customizations_module_url_ssm_path
   aws_region                                        = var.ct_home_region

modules/aft-account-provisioning-framework/lambda.tf

@@ -12,7 +12,7 @@ resource "aws_lambda_function" "create_role" {
   handler          = "aft_account_provisioning_framework_create_role.lambda_handler"
   source_code_hash = var.provisioning_framework_archive_hash
   memory_size      = 1024
-  runtime          = "python3.9"
+  runtime          = var.lambda_runtime_python_version
   timeout          = 300
   layers           = [var.aft_common_layer_arn]
 
@@ -39,7 +39,7 @@ resource "aws_lambda_function" "tag_account" {
   handler          = "aft_account_provisioning_framework_tag_account.lambda_handler"
   source_code_hash = var.provisioning_framework_archive_hash
   memory_size      = 1024
-  runtime          = "python3.9"
+  runtime          = var.lambda_runtime_python_version
   timeout          = 300
   layers           = [var.aft_common_layer_arn]
 
@@ -65,7 +65,7 @@ resource "aws_lambda_function" "persist_metadata" {
   handler          = "aft_account_provisioning_framework_persist_metadata.lambda_handler"
   source_code_hash = var.provisioning_framework_archive_hash
   memory_size      = 1024
-  runtime          = "python3.9"
+  runtime          = var.lambda_runtime_python_version
   timeout          = 300
   layers           = [var.aft_common_layer_arn]
 
@@ -93,7 +93,7 @@ resource "aws_lambda_function" "account_metadata_ssm" {
   handler          = "aft_account_provisioning_framework_account_metadata_ssm.lambda_handler"
   source_code_hash = var.provisioning_framework_archive_hash
   memory_size      = 1024
-  runtime          = "python3.9"
+  runtime          = var.lambda_runtime_python_version
   timeout          = 300
   layers           = [var.aft_common_layer_arn]
 

modules/aft-account-provisioning-framework/variables.tf

@@ -80,3 +80,7 @@ variable "enroll_support_lambda_function_name" {
 variable "enable_cloudtrail_lambda_function_name" {
   type = string
 }
+
+variable "lambda_runtime_python_version" {
+  type = string
+}

modules/aft-account-provisioning-framework/versions.tf

@@ -2,12 +2,12 @@
 # SPDX-License-Identifier: Apache-2.0
 #
 terraform {
-  required_version = ">= 0.15.1"
+  required_version = ">= 1.0.0"
 
   required_providers {
     aws = {
       source  = "hashicorp/aws"
-      version = ">= 4.27.0, < 5.0.0"
+      version = ">= 5.11.0, < 6.0.0"
     }
   }
 }

modules/aft-account-request-framework/lambda.tf

@@ -14,7 +14,7 @@ resource "aws_lambda_function" "aft_account_request_audit_trigger" {
 
   source_code_hash = var.request_framework_archive_hash
   memory_size      = 1024
-  runtime          = "python3.9"
+  runtime          = var.lambda_runtime_python_version
   timeout          = "300"
   layers           = [var.aft_common_layer_arn]
 
@@ -58,7 +58,7 @@ resource "aws_lambda_function" "aft_account_request_action_trigger" {
 
   source_code_hash = var.request_framework_archive_hash
   memory_size      = 1024
-  runtime          = "python3.9"
+  runtime          = var.lambda_runtime_python_version
   timeout          = "300"
   layers           = [var.aft_common_layer_arn]
 
@@ -96,7 +96,7 @@ resource "aws_lambda_function" "aft_controltower_event_logger" {
 
   source_code_hash = var.request_framework_archive_hash
   memory_size      = 1024
-  runtime          = "python3.9"
+  runtime          = var.lambda_runtime_python_version
   timeout          = "300"
   layers           = [var.aft_common_layer_arn]
 
@@ -133,7 +133,7 @@ resource "aws_lambda_function" "aft_account_request_processor" {
 
   source_code_hash = var.request_framework_archive_hash
   memory_size      = 1024
-  runtime          = "python3.9"
+  runtime          = var.lambda_runtime_python_version
   timeout          = "300"
   layers           = [var.aft_common_layer_arn]
 
@@ -177,7 +177,7 @@ resource "aws_lambda_function" "aft_invoke_aft_account_provisioning_framework" {
 
   source_code_hash = var.request_framework_archive_hash
   memory_size      = 1024
-  runtime          = "python3.9"
+  runtime          = var.lambda_runtime_python_version
   timeout          = "300"
   layers           = [var.aft_common_layer_arn]
 
@@ -215,7 +215,7 @@ resource "aws_lambda_function" "aft_cleanup_resources" {
 
   source_code_hash = var.request_framework_archive_hash
   memory_size      = 1024
-  runtime          = "python3.9"
+  runtime          = var.lambda_runtime_python_version
   timeout          = "300"
   layers           = [var.aft_common_layer_arn]
 

modules/aft-account-request-framework/variables.tf

@@ -51,3 +51,7 @@ variable "request_framework_archive_hash" {
 variable "concurrent_account_factory_actions" {
   type = number
 }
+
+variable "lambda_runtime_python_version" {
+  type = string
+}

modules/aft-account-request-framework/versions.tf

@@ -2,7 +2,7 @@
 # SPDX-License-Identifier: Apache-2.0
 #
 terraform {
-  required_version = ">= 0.15.1"
+  required_version = ">= 1.0.0"
 
   required_providers {
     aws = {

modules/aft-backend/versions.tf

@@ -2,7 +2,7 @@
 # SPDX-License-Identifier: Apache-2.0
 #
 terraform {
-  required_version = ">= 0.15.1"
+  required_version = ">= 1.0.0"
 
   required_providers {
     aws = {

modules/aft-code-repositories/buildspecs/ct-aft-account-provisioning-customizations.yml

@@ -51,7 +51,7 @@ phases:
           unzip -o terraform_${TF_VERSION}_linux_amd64.zip && mv terraform /usr/bin
           terraform -no-color --version
           cd $DEFAULT_PATH/terraform
-          for f in *.jinja; do jinja2 $f -D timestamp="$TIMESTAMP" -D tf_distribution_type=$TF_DISTRIBUTION -D region=$TF_BACKEND_REGION -D provider_region=$CT_MGMT_REGION -D bucket=$TF_S3_BUCKET -D key=$TF_S3_KEY -D dynamodb_table=$TF_DDB_TABLE -D kms_key_id=$TF_KMS_KEY_ID -D aft_admin_role_arn=$AFT_EXEC_ROLE_ARN >> ./$(basename $f .jinja).tf; done
+          for f in *.jinja; do jinja2 $f -D timestamp="$TIMESTAMP" -D tf_distribution_type=$TF_DISTRIBUTION -D region=$TF_BACKEND_REGION -D provider_region=$CT_MGMT_REGION -D bucket=$TF_S3_BUCKET -D key=$TF_S3_KEY -D dynamodb_table=$TF_DDB_TABLE -D kms_key_id=$TF_KMS_KEY_ID -D aft_admin_role_arn=$AFT_EXEC_ROLE_ARN -D tf_version=$TF_VERSION >> ./$(basename $f .jinja).tf; done
           for f in *.tf; do echo "\n \n"; echo $f; cat $f; done
           JSON=$(aws sts assume-role --role-arn ${AFT_ADMIN_ROLE_ARN} --role-session-name ${ROLE_SESSION_NAME})
           #Make newly assumed role default session

modules/aft-code-repositories/buildspecs/ct-aft-account-request.yml

@@ -51,7 +51,7 @@ phases:
           unzip -o terraform_${TF_VERSION}_linux_amd64.zip && mv terraform /usr/bin
           terraform --version
           cd $DEFAULT_PATH/terraform
-          for f in *.jinja; do jinja2 $f -D timestamp="$TIMESTAMP" -D tf_distribution_type=$TF_DISTRIBUTION -D provider_region=$CT_MGMT_REGION -D region=$TF_BACKEND_REGION -D bucket=$TF_S3_BUCKET -D key=$TF_S3_KEY -D dynamodb_table=$TF_DDB_TABLE -D kms_key_id=$TF_KMS_KEY_ID -D aft_admin_role_arn=$AFT_EXEC_ROLE_ARN >> ./$(basename $f .jinja).tf; done
+          for f in *.jinja; do jinja2 $f -D timestamp="$TIMESTAMP" -D tf_distribution_type=$TF_DISTRIBUTION -D provider_region=$CT_MGMT_REGION -D region=$TF_BACKEND_REGION -D bucket=$TF_S3_BUCKET -D key=$TF_S3_KEY -D dynamodb_table=$TF_DDB_TABLE -D kms_key_id=$TF_KMS_KEY_ID -D aft_admin_role_arn=$AFT_EXEC_ROLE_ARN -D tf_version=$TF_VERSION >> ./$(basename $f .jinja).tf; done
           for f in *.tf; do echo "\n \n"; echo $f; cat $f; done
           JSON=$(aws sts assume-role --role-arn ${AFT_ADMIN_ROLE_ARN} --role-session-name ${ROLE_SESSION_NAME})
           #Make newly assumed role default session

modules/aft-code-repositories/codebuild.tf

@@ -23,7 +23,7 @@ resource "aws_codebuild_project" "account_request" {
 
   environment {
     compute_type                = "BUILD_GENERAL1_MEDIUM"
-    image                       = "aws/codebuild/amazonlinux2-x86_64-standard:4.0"
+    image                       = "aws/codebuild/amazonlinux2-x86_64-standard:5.0"
     type                        = "LINUX_CONTAINER"
     image_pull_credentials_type = "CODEBUILD"
     environment_variable {
@@ -75,7 +75,7 @@ resource "aws_codebuild_project" "account_provisioning_customizations_pipeline"
 
   environment {
     compute_type                = "BUILD_GENERAL1_MEDIUM"
-    image                       = "aws/codebuild/amazonlinux2-x86_64-standard:4.0"
+    image                       = "aws/codebuild/amazonlinux2-x86_64-standard:5.0"
     type                        = "LINUX_CONTAINER"
     image_pull_credentials_type = "CODEBUILD"
 

modules/aft-code-repositories/versions.tf

@@ -2,12 +2,12 @@
 # SPDX-License-Identifier: Apache-2.0
 #
 terraform {
-  required_version = ">= 0.15.1"
+  required_version = ">= 1.0.0"
 
   required_providers {
     aws = {
       source  = "hashicorp/aws"
-      version = ">= 4.27.0, < 5.0.0"
+      version = ">= 5.11.0, < 6.0.0"
     }
   }
 }

modules/aft-customizations/buildspecs/aft-account-customizations-terraform.yml

@@ -109,7 +109,7 @@ phases:
             /opt/aft/bin/terraform -no-color --version
 
             cd $DEFAULT_PATH/$CUSTOMIZATION/terraform
-            for f in *.jinja; do jinja2 $f -D timestamp="$TIMESTAMP" -D tf_distribution_type=$TF_DISTRIBUTION -D provider_region=$CT_MGMT_REGION -D region=$TF_BACKEND_REGION -D aft_admin_role_arn=$AFT_EXEC_ROLE_ARN -D target_admin_role_arn=$VENDED_EXEC_ROLE_ARN -D bucket=$TF_S3_BUCKET -D key=$TF_S3_KEY -D dynamodb_table=$TF_DDB_TABLE -D kms_key_id=$TF_KMS_KEY_ID >> ./$(basename $f .jinja).tf; done
+            for f in *.jinja; do jinja2 $f -D timestamp="$TIMESTAMP" -D tf_distribution_type=$TF_DISTRIBUTION -D provider_region=$CT_MGMT_REGION -D region=$TF_BACKEND_REGION -D aft_admin_role_arn=$AFT_EXEC_ROLE_ARN -D target_admin_role_arn=$VENDED_EXEC_ROLE_ARN -D bucket=$TF_S3_BUCKET -D key=$TF_S3_KEY -D dynamodb_table=$TF_DDB_TABLE -D kms_key_id=$TF_KMS_KEY_ID -D tf_version=$TF_VERSION >> ./$(basename $f .jinja).tf; done
             for f in *.tf; do echo "\n \n"; echo $f; cat $f; done
             
             cd $DEFAULT_PATH/$CUSTOMIZATION/terraform

modules/aft-customizations/buildspecs/aft-create-pipeline.yml

@@ -62,7 +62,7 @@ phases:
     on-failure: ABORT
     commands:
       - cd $DEFAULT_PATH/aws-aft-core-framework/sources/aft-customizations-common/templates/customizations_pipeline
-      - for f in *.jinja; do jinja2 $f -D timestamp="$TIMESTAMP" -D region=$TF_BACKEND_REGION -D bucket=$TF_S3_BUCKET -D key=$TF_S3_KEY -D dynamodb_table=$TF_DDB_TABLE -D kms_key_id=$TF_KMS_KEY_ID >> $(basename $f .jinja).tf; done
+      - for f in *.jinja; do jinja2 $f -D timestamp="$TIMESTAMP" -D region=$TF_BACKEND_REGION -D bucket=$TF_S3_BUCKET -D key=$TF_S3_KEY -D dynamodb_table=$TF_DDB_TABLE -D kms_key_id=$TF_KMS_KEY_ID -D tf_version=$TF_VERSION >> $(basename $f .jinja).tf; done
       - for f in *.tf; do echo "\n \n"; echo $f; cat $f; done
   build:
     on-failure: ABORT

modules/aft-customizations/buildspecs/aft-global-customizations-terraform.yml

@@ -91,7 +91,7 @@ phases:
 
           # Move back to customization module
           cd $DEFAULT_PATH/terraform
-          for f in *.jinja; do jinja2 $f -D timestamp="$TIMESTAMP" -D tf_distribution_type=$TF_DISTRIBUTION -D provider_region=$CT_MGMT_REGION -D region=$TF_BACKEND_REGION -D aft_admin_role_arn=$AFT_EXEC_ROLE_ARN -D target_admin_role_arn=$VENDED_EXEC_ROLE_ARN -D bucket=$TF_S3_BUCKET -D key=$TF_S3_KEY -D dynamodb_table=$TF_DDB_TABLE -D kms_key_id=$TF_KMS_KEY_ID >> ./$(basename $f .jinja).tf; done
+          for f in *.jinja; do jinja2 $f -D timestamp="$TIMESTAMP" -D tf_distribution_type=$TF_DISTRIBUTION -D provider_region=$CT_MGMT_REGION -D region=$TF_BACKEND_REGION -D aft_admin_role_arn=$AFT_EXEC_ROLE_ARN -D target_admin_role_arn=$VENDED_EXEC_ROLE_ARN -D bucket=$TF_S3_BUCKET -D key=$TF_S3_KEY -D dynamodb_table=$TF_DDB_TABLE -D kms_key_id=$TF_KMS_KEY_ID -D tf_version=$TF_VERSION >> ./$(basename $f .jinja).tf; done
           for f in *.tf; do echo "\n \n"; echo $f; cat $f; done
 
           cd $DEFAULT_PATH/terraform

modules/aft-customizations/codebuild.tf

@@ -19,7 +19,7 @@ resource "aws_codebuild_project" "aft_global_customizations_terraform" {
 
   environment {
     compute_type                = "BUILD_GENERAL1_MEDIUM"
-    image                       = "aws/codebuild/amazonlinux2-x86_64-standard:4.0"
+    image                       = "aws/codebuild/amazonlinux2-x86_64-standard:5.0"
     type                        = "LINUX_CONTAINER"
     image_pull_credentials_type = "CODEBUILD"
 
@@ -89,7 +89,7 @@ resource "aws_codebuild_project" "aft_account_customizations_terraform" {
 
   environment {
     compute_type                = "BUILD_GENERAL1_MEDIUM"
-    image                       = "aws/codebuild/amazonlinux2-x86_64-standard:4.0"
+    image                       = "aws/codebuild/amazonlinux2-x86_64-standard:5.0"
     type                        = "LINUX_CONTAINER"
     image_pull_credentials_type = "CODEBUILD"
     environment_variable {
@@ -158,7 +158,7 @@ resource "aws_codebuild_project" "aft_create_pipeline" {
 
   environment {
     compute_type                = "BUILD_GENERAL1_MEDIUM"
-    image                       = "aws/codebuild/amazonlinux2-x86_64-standard:4.0"
+    image                       = "aws/codebuild/amazonlinux2-x86_64-standard:5.0"
     type                        = "LINUX_CONTAINER"
     image_pull_credentials_type = "CODEBUILD"