.
├── accounts/              # アカウント定義
│   ├── example-dev.yaml
│   └── example-prd.yaml
├── accounts.tf            # アカウントファクトリーの起動
├── organizations.tf       # OUパスからOU IDを参照
├── locals.tf              # YAMLの読み込みとパラメータの組み立て
└── providers.tf

# Service Catalogの製品「AWS Control Tower Account Factory」に渡すパラメータ
# キー名はService Catalogコンソールの入力項目と同じ
provisioning_parameters:
  AccountName: Example-Dev
  AccountEmail: aws+example-dev@example.com
  ManagedOrganizationalUnit: Workloads/Dev
  SSOUserEmail: aws+example-dev@example.com
  SSOUserFirstName: AWS
  SSOUserLastName: Admin

# プロビジョニングされた製品に付けるタグ
tags:
  created-by: terraform
  system: example
  environment: development

locals {
  # Control Towerホームリージョンのアカウントファクトリーの製品ID
  #   aws servicecatalog describe-product --name "AWS Control Tower Account Factory" \
  #     --region ap-northeast-1 --query 'ProductViewSummary.ProductId' --output text
  account_factory_product_id = "prod-xxxxxxxxxxxxx"

  # accounts/配下のYAMLを読み込み、拡張子を除いたファイル名をキーにする
  accounts = {
    for filename in fileset("${path.module}/accounts", "*.yaml") :
    trimsuffix(filename, ".yaml") => yamldecode(file("${path.module}/accounts/${filename}"))
  }

  # ManagedOrganizationalUnitは "OU名 (OU ID)" の形式で渡す必要がある
  # OU名はパスではなく配置先のOU単体の名前なので、パスの末尾を使う
  # それ以外のパラメータはYAMLの内容をそのまま製品に渡す
  provisioning_parameters = {
    for key, account in local.accounts : key => merge(
      account.provisioning_parameters,
      {
        ManagedOrganizationalUnit = format(
          "%s (%s)",
          reverse(split("/", account.provisioning_parameters.ManagedOrganizationalUnit))[0],
          local.ou_ids[account.provisioning_parameters.ManagedOrganizationalUnit],
        )
      }
    )
  }

  # ランディングゾーンの更新でIDが変わるため、有効なバージョンを動的に参照する
  active_provisioning_artifact_id = one([
    for artifact in data.aws_servicecatalog_provisioning_artifacts.account_factory.provisioning_artifact_details :
    artifact.id if artifact.active
  ])
}

# OUはRoot配下に最大5階層までネストできる
# https://docs.aws.amazon.com/organizations/latest/userguide/orgs_reference_limits.html
#
# aws_organizations_organizational_unitsは parent_id の直下しか返さないため、
# Rootから5階層分のデータソースを連鎖させて、全OUを引けるようにする

data "aws_organizations_organization" "this" {}

data "aws_organizations_organizational_units" "level1" {
  parent_id = data.aws_organizations_organization.this.roots[0].id
}

data "aws_organizations_organizational_units" "level2" {
  for_each = local.ou_level1

  parent_id = each.value
}

## 中略(level3からlevel5も同じ形で、1つ上の階層のマップをfor_eachに渡す)

locals {
  # 各階層の "OUパス => OU ID" のマップ
  # 1階層下のfor_eachのキーがそのまま親のパスになるので、連結していけばフルパスになる
  ou_level1 = {
    for ou in data.aws_organizations_organizational_units.level1.children : ou.name => ou.id
  }

  ou_level2 = merge([
    for parent, ous in data.aws_organizations_organizational_units.level2 : {
      for ou in ous.children : "${parent}/${ou.name}" => ou.id
    }
  ]...)

  ## 中略(ou_level3からou_level5も同じ形)

  # OUの指定からOU IDを参照するためのマップ
  # ネストしたOUは名前が重複しうるため、Rootからのパスをキーにする
  ou_ids = merge(
    local.ou_level1,
    local.ou_level2,
    local.ou_level3,
    local.ou_level4,
    local.ou_level5,
  )
}

data "aws_servicecatalog_provisioning_artifacts" "account_factory" {
  product_id = local.account_factory_product_id
}

resource "aws_servicecatalog_provisioned_product" "account" {
  for_each = local.accounts

  name                     = each.value.provisioning_parameters.AccountName
  product_id               = local.account_factory_product_id
  provisioning_artifact_id = local.active_provisioning_artifact_id

  dynamic "provisioning_parameters" {
    for_each = local.provisioning_parameters[each.key]

    content {
      key   = provisioning_parameters.key
      value = provisioning_parameters.value
    }
  }

  tags = each.value.tags

  # 既定の30分では足りない場合があるため延長する
  timeouts {
    create = "60m"
    update = "60m"
    delete = "60m"
  }
}

terraform {
  required_version = "~> 1.16"

  required_providers {
    aws = {
      source  = "hashicorp/aws"
      version = "~> 6.68"
    }
  }
}

provider "aws" {
  region = "ap-northeast-1"
}

aws servicecatalog describe-product \
  --name "AWS Control Tower Account Factory" \
  --region ap-northeast-1 \
  --query 'ProductViewSummary.ProductId' \
  --output text

prod-xxxxxxxxxxxxx

terraform plan

Terraform will perform the following actions:

  # aws_servicecatalog_provisioned_product.account["example-dev"] will be created
  + resource "aws_servicecatalog_provisioned_product" "account" {
      + accept_language                        = "en"
      + arn                                    = (known after apply)
      + id                                     = (known after apply)
      + ignore_errors                          = false
      + name                                   = "Example-Dev"
      + outputs                                = (known after apply)
      + path_id                                = (known after apply)
      + product_id                             = "prod-xxxxxxxxxxxxx"
      + provisioning_artifact_id               = "pa-xxxxxxxxxxxxx"
      + region                                 = "ap-northeast-1"
      + retain_physical_resources              = false
      + status                                 = (known after apply)
      + tags                                   = {
          + "created-by"  = "terraform"
          + "environment" = "development"
          + "system"      = "example"
        }

      + provisioning_parameters {
          + key   = "AccountEmail"
          + value = "aws+example-dev@example.com"
        }
      + provisioning_parameters {
          + key   = "AccountName"
          + value = "Example-Dev"
        }
      + provisioning_parameters {
          + key   = "ManagedOrganizationalUnit"
          + value = "Dev (ou-xxxx-xxxxxxxx)"
        }
      + provisioning_parameters {
          + key   = "SSOUserEmail"
          + value = "aws+example-dev@example.com"
        }
      + provisioning_parameters {
          + key   = "SSOUserFirstName"
          + value = "AWS"
        }
      + provisioning_parameters {
          + key   = "SSOUserLastName"
          + value = "Admin"
        }

      + timeouts {
          + create = "60m"
          + delete = "60m"
          + update = "60m"
        }
    }

## 省略（example-prdも同様）

Plan: 2 to add, 0 to change, 0 to destroy.

terraform apply

terraform state show 'aws_servicecatalog_provisioned_product.account["example-dev"]'

    status = "AVAILABLE"
    type   = "CONTROL_TOWER_ACCOUNT"
    outputs = [
      {
        key   = "AccountId"
        value = "XXXXXXXXXXXX"
      },
      ## 中略
    ]