How do I troubleshoot an AWSControlTowerExecution role error that occurs during AWS Control Tower account enrollment?

Resolution

Note: If you receive errors when you run AWS Command Line Interface (AWS CLI) commands, then see Troubleshooting errors for the AWS CLI. Also, make sure that you're using the most recent AWS CLI version.

When you enroll an account in AWS Control Tower, the AWSControlTowerExecution role must be present and properly configured for the account. If it isn't, then you might receive the following error message:

"AWS Control Tower is unable to assume the AWSControlTowerExecution role in the account. Add the role to your account if it's not present, and try again"

Sign in to the account that you want to enroll in AWS Control Tower. Then, check whether the AWSControlTowerExecution role is present in the AWS Identity and Access Management (IAM) console. If it's present, then check whether the role has a trust relationship with the AWS Organizations management account. Also, check whether the role has an attached administrative access policy.

If the role isn't present in the account, and the account is part of a registered organizational unit (OU), then take the following actions:

• Move the account under the root level of your organization in the AWS Organizations console. If the account is under a registered OU, then terminate the provisioned product. Then, you can create the AWSControlTowerExecution role without being blocked by a service control policy.
• Create the IAM role.

To create the IAM role, complete the following steps:

1. Navigate to the IAM service in the AWS Management Console.
2. Choose Roles.
3. Choose Create role, and then choose Custom trust policy.
4. Insert the following trust policy.

   {
   "Version": "2012-10-17",
   "Statement": [
   {
   "Effect": "Allow",
   "Principal": {
   "AWS": "arn:aws:iam::Management Account ID:root"
   },
   "Action": "sts:AssumeRole",
   "Condition": {}
   }
   ]
   }

   Note: Replace Management Account ID with your AWS Management Account ID.
5. Attach the AdministratorAccess policy.
6. Skip the Tags section (optional).
7. In the Review section, add the following details:
   Role name: AWSControlTowerExecution
   Description: "Allows full account access for enrollment"
8. Choose Create role.

If the member account has the AWSControlTowerExecution role, but the trust relationship is incorrect and the product is in a failed state, then take the following actions:

• Move the account under the root level of your organization in the AWS Organizations console, or delete the provisioned product.
• Edit the trust relationship of the AWSControlTowerExecution role. To do this, assume the AWS Management Account ID.

Note: If you need to create a role for multiple accounts, then re-register the OU. This action automatically creates the AWSControlTowerExecution role in all accounts within that OU.

Related information

Manually add the required IAM role to an existing AWS account and enroll it