AWS Control TowerのメンバーアカウントをTerraformで作成する [Not AFT]

## アカウントファクトリーの製品IDを引数とし、プロビジョニングアーティファクト（＝製品の各バージョンごとの情報）のリストを取得
data "aws_servicecatalog_provisioning_artifacts" "ct" {
  product_id = local.ct_product_id
}

locals {
  ct_product_id = "prod-xxxxxxxxx" ## CTホームリージョンのAWS Control Tower Account Factoryの製品ID
  provisioning_params = { ## Control Towerコンソールで入力が求められるパラメータ同様
    lemon = {
      AccountEmail              = "lemon@example.com"
      AccountName               = "Lemon"
      ManagedOrganizationalUnit = "Sandbox"
      SSOUserEmail              = "management@example.com"
      SSOUserFirstName          = "NOT"
      SSOUserLastName           = "USE"
    }
  }
  ## 製品バージョンのリストのうち、最新版（=active）のみを取得するためfor文とif文を活用
  active_pa = [
    for artifact in data.aws_servicecatalog_provisioning_artifacts.ct.provisioning_artifact_details :
    artifact if artifact.active == true
  ]
}

resource "aws_servicecatalog_provisioned_product" "lemon" {
  name                     = local.provisioning_params.lemon.AccountName
  product_id               = local.ct_product_id
  provisioning_artifact_id = local.active_pa[0].id ## ランディングゾーンを更新するとIDが変わるので、データソースより動的に取得

  ## ベタ書きだと冗長的になるnestedブロックをdynamicブロックでくり返しを回避
  dynamic "provisioning_parameters" {
    for_each = local.provisioning_params.lemon
    content {
      key   = provisioning_parameters.key
      value = provisioning_parameters.value
    }
  }
  tags = {
    "created-by" = "terraform"
  }
}

% terraform plan

Terraform used the selected providers to generate the following execution plan. Resource actions are indicated with the following
symbols:
  + create

Terraform will perform the following actions:

  # aws_servicecatalog_provisioned_product.lemon will be created
  + resource "aws_servicecatalog_provisioned_product" "lemon" {
      + accept_language                        = "en"
      + arn                                    = (known after apply)
      + cloudwatch_dashboard_names             = (known after apply)
      + created_time                           = (known after apply)
      + id                                     = (known after apply)
      + ignore_errors                          = false
      + last_provisioning_record_id            = (known after apply)
      + last_record_id                         = (known after apply)
      + last_successful_provisioning_record_id = (known after apply)
      + launch_role_arn                        = (known after apply)
      + name                                   = "Lemon"
      + outputs                                = (known after apply)
      + path_id                                = (known after apply)
      + product_id                             = "prod-xxxxxxxxxx"
      + provisioning_artifact_id               = "pa-xxxxxxxxxx"
      + retain_physical_resources              = false
      + status                                 = (known after apply)
      + status_message                         = (known after apply)
      + tags                                   = {
          + "created-by" = "terraform"
        }
      + type                                   = (known after apply)

      + provisioning_parameters {
          + key   = "AccountEmail"
          + value = "lemon@exampl.com"
        }
      + provisioning_parameters {
          + key   = "AccountName"
          + value = "Lemon"
        }
      + provisioning_parameters {
          + key   = "ManagedOrganizationalUnit"
          + value = "Sandbox"
        }
      + provisioning_parameters {
          + key   = "SSOUserEmail"
          + value = "management@example.com"
        }
      + provisioning_parameters {
          + key   = "SSOUserFirstName"
          + value = "NOT"
        }
      + provisioning_parameters {
          + key   = "SSOUserLastName"
          + value = "USE"
        }
    }

Plan: 1 to add, 0 to change, 0 to destroy.

% terraform apply

## 中略

aws_servicecatalog_provisioned_product.lemon: Still creating... [10m20s elapsed]
aws_servicecatalog_provisioned_product.lemon: Creation complete after 10m21s [id=pp-xxxxxxx]

Apply complete! Resources: 1 added, 0 changed, 0 destroyed.