How do I troubleshoot the "ConstraintViolationException" error when I close member accounts in my organization?

Short description

AWS Organizations limits the number of accounts you can close within any rolling 30-day period. By default, you can close 20% of your total member accounts or 250 within any 30-day period. The minimum quota for account closures is 250 accounts, and the maximum is 1,000 accounts. You can't increase this quota. For example, if your organization has 2,000 member accounts, then your quota is 400 account closures within any 30-day period. If your organization has 500 member accounts, then your quota is 250 account closures.

If you exceed the quota, then you receive the following error:

"ConstraintViolationException - You have exceeded close account quota for the past 30 days."

The quota's time frame starts from the date of the first account closure, not from the beginning of a calendar month. After 30 days from the initial account closure, you can close additional accounts.

Resolution

Prerequisite: You can close an account in AWS Organizations only after you turn on all features.

Note: The Close Account action is asynchronous from other processes. You might receive a successful completion message even if the account closure is still in progress. If this happens, then wait a few minutes for the account to fully close, and then verify the account status.

To check the status of an account closure request, use the DescribeAccount API or check AWS CloudTrail logs.

Use the DescribeAccount API

Run the following describe-account command to retrieve information about the account:

aws organizations describe-account --account-id AccountId

Note: Replace AccountId with the account ID that you sent in the CloseAccount request. If you receive errors when you run AWS Command Line Interface (AWS CLI) commands, then see Troubleshooting errors for the AWS CLI. Also, make sure that you're using the most recent AWS CLI version.

In the output, check the Status element. When the account closure request is in progress, this status is PENDING_CLOSURE. When the request completes, the status changes to SUSPENDED.

Monitor the CloudTrail event

Check the CloudTrail log for the CloseAccountResult event. CloudTrail publishes this event after the account closes successfully. For more information, see Logging API calls with AWS CloudTrail for AWS Organizations.

Related information

Closing a member account in an organization with AWS Organizations