S3 backend Jinja templates use deprecated top-level role_arn, incompatible with Terraform >= 1.10

[yeoli9]

Terraform Version & Prov: 1.13.2 (also affects any version >= 1.10.0)

AFT Version: 1.19.0
(Can be found in the AFT Management Account in the SSM Parameter /aft/config/aft/version)

Terraform Version & Provider Versions
Please provide the outputs of terraform version and terraform providers from within your AFT environment

terraform version

Terraform v1.13.2
on linux_amd64

terraform providers

hashicorp/aws >= 6.0.0, < 7.0.0

Bug Description

AFT's S3 backend Jinja templates (OSS distribution) generate backend.tf with a top-level role_arn argument. This argument was deprecated in Terraform 1.6 and removed in Terraform 1.10 ([hashicorp/terraform#35721](hashicorp/terraform#35721)). As a result, all AFT pipelines fail at terraform init when terraform_version is set to any version >= 1.10.0.

The generated backend.tf looks like:

terraform {
  backend "s3" {
    region         = "ap-northeast-2"
    bucket         = "aft-backend-XXXXXXXXXXXX-primary-region"
    key            = "account-request/terraform.tfstate"
    dynamodb_table = "aft-backend-XXXXXXXXXXXX"
    encrypt        = "true"
    kms_key_id     = "xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx"
    role_arn       = "arn:aws:iam::XXXXXXXXXXXX:role/AWSAFTExecution"  # removed in 1.10
  }
}

The correct syntax for Terraform >= 1.10 should be:

terraform {
  backend "s3" {
    # ...
    assume_role = {
      role_arn = "arn:aws:iam::XXXXXXXXXXXX:role/AWSAFTExecution"
    }
  }
}

To Reproduce

1. Deploy AFT with terraform_distribution = "oss" and terraform_version set to any version >= 1.10.0 (e.g. 1.13.2)
2. Push a change to any AFT pipeline repository (e.g. aft-account-request, aft-account-provisioning-customizations)
3. CodeBuild PRE_BUILD phase fails at terraform init

Expected behavior

AFT Jinja templates should generate the assume_role = {} block syntax when the configured Terraform version is >= 1.10.0. Alternatively, AFT should validate the terraform_version input and reject unsupported versions with a clear error message.

The [AFT documentation](https://docs.aws.amazon.com/controltower/latest/userguide/version-supported.html) states "AFT supports Terraform version 1.6.0 or later", but in practice OSS distribution is limited to < 1.10.0 due to this issue.

Related Logs

Initializing the backend...

Error: Unsupported argument

  on backend.tf line 13, in terraform:
  13:     role_arn       = "arn:aws:iam::XXXXXXXXXXXX:role/AWSAFTExecution"

An argument named "role_arn" is not expected here.

Additional context

• This issue affects all four AFT pipeline buildspecs that generate S3 backend configs via Jinja templates: account-request, account-provisioning-customizations, account-customizations, and global-customizations.
• This does not affect TFC/TFE distributions, only the OSS distribution with S3 backend.
• Current workaround: set terraform_version = "1.9.8" (the latest patch that still supports top-level role_arn).