Can we ask for a Control Tower control to be updated [AWS-GR_REGION_DENY]?

As to my knowledge NO, you cannot directly update or modify the AWS-GR_REGION_DENY control or its underlying Service Control Policy (SCP) - you can request this change from AWS.

AWS Control Tower managed SCPs are immutable and strictly maintained by AWS to guarantee baseline compliance. Any manual modification to a managed SCP will trigger a governance drift state and will be automatically reverted during Control Tower updates.

If you want uxc:GetAccountColor added to the NotAction statement, you must submit a formal feature request to the AWS Control Tower team. You can do this by opening a "Product Feedback" case in the AWS Support Center or by contacting your AWS Technical Account Manager (TAM).

Currently, the only technically supported way I know is, to achieve this specific exception is to disable the managed control and deploy a Custom SCP tailored to your needs, even if it requires extra overhead.

Official References:

• Region Deny Control immutable design: AWS Documentation - Configure the Region deny control -> https://docs.aws.amazon.com/controltower/latest/userguide/region-deny.html

• Submitting Feature Requests: AWS re:Post - How to Create a Feature Request for AWS -> https://repost.aws/articles/ARU82W8PxQTzeF3j6AlxJwiA/how-to-create-a-feature-request-for-aws-a-step-by-step-guide

Control Tower offers 2 region deny controls:

• Landing zone region deny (AWS-GR_REGION_DENY)
• OU region deny (CT.MULTISERVICE.PV.1)

Landing zone region deny is rigid and does not allow any modification at this time. For issues like this, you may consider disabling the landing zone region deny and enable the OU region deny which allows you to add specific services or API actions as exception when enabling the control. You can still submit a feature request, but if you're looking for an immediate solution, I'd suggest looking into the OU region deny.