"Can I Have an AWS Account?"
In a manual world, this request triggers a two-week ticket queue: a security review, a network team provisioning a VPC, a billing team setting up cost allocation tags, and an IAM team configuring SSO. By the time the account is ready, the developer has worked around the process entirely — usually by using a personal credit card.
In a Control Tower world, you use the Account Factory — often called the Account Vending Machine (AVM). It is a self-service provisioning system backed by AWS Service Catalog.
How it works:
- A developer (or platform team member with permission) opens the Account Factory in the Control Tower console or Service Catalog portal.
- They fill in a form: account name, email address, target OU, and any custom parameters your organization has defined.
- Account Factory triggers a Service Catalog product, which runs a CloudFormation StackSet across the new account.
- Within 15–30 minutes, the account is fully provisioned with:
- A pre-configured VPC (or no VPC, if your baseline deletes the default)
- CloudTrail and Config already shipping logs to the Log Archive account
- SSO permission sets already assigned to the requesting team
- SCPs inherited from the target OU already in effect
- Any custom baseline resources your organization has defined (e.g., a standard S3 bucket for Terraform state)
Account Factory Customization (AFC): Control Tower now supports Account Factory for Terraform (AFT), which replaces the Service Catalog-based vending machine with a Terraform pipeline. Teams submit a pull request to a Git repository with their account request parameters, and a CodePipeline runs the provisioning. This is the preferred approach for organizations already standardized on Terraform, as it brings account provisioning into the same GitOps workflow as infrastructure.
Interviewers frequently ask: "How do you handle account provisioning at scale?" The weak answer is "we use the AWS console." The strong answer describes Account Factory or AFT, explains that every account is provisioned from a standard template, and mentions that customizations are applied via StackSets or Terraform pipelines — not manual steps. Bonus points for mentioning that the account request itself can be a pull request, giving you a full audit trail of who requested what and when.