TerraformでControl Tower管理下のAWSアカウントを別のOUに移動する(AFTなし)

resource "aws_organizations_account" "sandbox" {
  email     = "sandbox@example.com"
  name      = "Sandbox"
  parent_id = "ou-XXXXX"
}

import {
  to = aws_servicecatalog_provisioned_product.sandbox
  id = "pp-XXXXX" # 前の手順で取得したID
}

terraform plan -generate-config-out=service_catlog.tf

# __generated__ by Terraform
# Please review these resources and move them into your main configuration files.

# __generated__ by Terraform from "pp-XXXXX"
resource "aws_servicecatalog_provisioned_product" "sandbox" {
  accept_language            = null
  ignore_errors              = null
  name                       = "Enroll-Account-XXXXXX"
  notification_arns          = null
  path_id                    = "lpv3-XXXXX"
  path_name                  = null
  product_id                 = "prod-XXXXX"
  product_name               = null
  provisioning_artifact_id   = "pa-XXXXX"
  provisioning_artifact_name = null
  retain_physical_resources  = null
  tags                       = {}
  tags_all                   = {}
}

resource "aws_servicecatalog_provisioned_product" "sandbox1" {
  name                     = "Enroll-Account-12345678901"
  path_id                  = "lpv3-xxxxxx"
  product_id               = "prod-xxxxxxx"
  provisioning_artifact_id = "pa-xxxxxxx"

  provisioning_parameters {
    key   = "AccountName"
    value = "AWS Team Masaki Sato Sandbox 1"
  }
  provisioning_parameters {
    key   = "AccountEmail"
    value = "sandbox@example.com"
  }
  provisioning_parameters {
    key   = "ManagedOrganizationalUnit"
    value = "ControlTowerTest1 (ou-XXXXXX)"
  }
  provisioning_parameters {
    key   = "SSOUserFirstName"
    value = "NOT"
  }
  provisioning_parameters {
    key   = "SSOUserLastName"
    value = "USE"
  }
  provisioning_parameters {
    key   = "SSOUserEmail"
    value = "sandbox@example.com"
  }
}

terraform plan
terraform apply

resource "aws_organizations_account" "sandbox" {
  email     = "sandbox@example.com"
  name      = "Sandbox"
-  parent_id = "ou-XXXXX"
+  lifecycle {
+    ignore_changes = [
+      parent_id
+    ]
+  }  
}

terraform plan
# 実行結果抜粋
No changes. Your infrastructure matches the configuration.

resource "aws_servicecatalog_provisioned_product" "sandbox1" {
  name                     = "Enroll-Account-12345678901"
  path_id                  = "lpv3-xxxxxx"
  product_id               = "prod-xxxxxxx"
  provisioning_artifact_id = "pa-xxxxxxx"

  provisioning_parameters {
    key   = "AccountName"
    value = "AWS Team Masaki Sato Sandbox 1"
  }
  provisioning_parameters {
    key   = "AccountEmail"
    value = "sandbox@example.com"
  }
  provisioning_parameters {
    key   = "ManagedOrganizationalUnit"
+    value = "ControlTowerTest2 (ou-YYYYYY)"
-    value = "ControlTowerTest1 (ou-XXXXXX)"
  }
  provisioning_parameters {
    key   = "SSOUserFirstName"
    value = "NOT"
  }
  provisioning_parameters {
    key   = "SSOUserLastName"
    value = "USE"
  }
  provisioning_parameters {
    key   = "SSOUserEmail"
    value = "sandbox@example.com"
  }
}

terraform plan
# 抜粋
      ~ provisioning_parameters {
          ~ value              = "ControlTowerTest1 (ou-XXXXXX)" -> "ControlTowerTest2 (ou-YYYYYYY)"
            # (2 unchanged attributes hidden)
        }

terraform apply