How do I resolve the "AWSServiceRoleForAWSControlTower has been taken" error message in AWS Control Tower?

Short description

During setup, AWS Control Tower uses the AWSControlTowerBP-BASELINE-SERVICE-LINKED-ROLE StackSet to create the service-linked role AWSServiceRoleForAWSControlTower in all member accounts. This role has a DeletionPolicy of Retain in the AWS CloudFormation template. If you delete the stack instance for a role that's already in the member account, then AWS Control Tower fails to recreate the role. If you try to update the landing zone and the role already exists, then you receive the following error message:

"Service role name AWSServiceRoleForAWSControlTower has been taken in this account, please try a different suffix"

To resolve this error, import the existing service-linked role into a new CloudFormation stack in the member account. Delete the failed stack instance from the StackSet, and then import the stack back into the StackSet. Then, retry the landing zone update.

Resolution

Prerequisites: Confirm that you have the correct permissions attached to your AWS Identity and Access Management (IAM) roles.

Import the service-linked role into a new CloudFormation stack

In your member account, complete the following steps:

1. Delete the stack instance StackSet-AWSControlTowerBP-BASELINE-SERVICE-LINKED-ROLE-##### from the member account.
   Note: If the stack instance is stuck in the DELETE_FAILED state, then see Delete a stack from the CloudFormation console.

2. Create a CloudFormation template file with the following configuration:

   AWSTemplateFormatVersion: 2010-09-09
   Description: Configure Control Tower Service Linked Role
   Parameters:
     ServicePrincipal:
       Type: String
       Description: 'AWS Control Tower service principal'
   Resources:
     ControlTowerServiceRole:
       DeletionPolicy: Retain
       Type: AWS::IAM::ServiceLinkedRole
       Properties:
         AWSServiceName: !Ref ServicePrincipal
         Description: 'Provides access to AWS Resources managed or used by AWS Control Tower'

3. Open the CloudFormation console in the member account in the home AWS Region of AWS Control Tower.

4. Choose Create stack, and then choose With existing resources (import resources).

5. Upload the CloudFormation template file.

6. On the Identify resources page, for RoleName, enter AWSServiceRoleForAWSControlTower.

7. On the Specify stack details page, for Stack name, enter the original stack instance name from the error message. For example, enter StackSet-AWSControlTowerBP-BASELINE-SERVICE-LINKED-ROLE-#####.

8. In the Parameters section, for ServicePrincipal, enter controltower.amazonaws.com, and then choose Next.

9. Review the stack details, and then choose Import resources to create the stack.

Delete the failed stack instance from the StackSet

Complete the following steps:

1. In the management account, open the CloudFormation console.
2. From the navigation pane, choose StackSets.
3. Select the AWSControlTowerBP-BASELINE-SERVICE-LINKED-ROLE StackSet.
4. On the Actions menu, choose Delete stacks from stack set.
5. Under Set deployment options, for Accounts, choose the member account ID.
6. For Specify Regions, select the home Region that the failure occurred in.
7. Choose Next, validate your selections, and then choose Submit.

For more information, see Delete stacks from CloudFormation StackSets.

Import the stack into the StackSet

Complete the following steps:

1. In the management account, open the CloudFormation console.
2. From the navigation pane, choose StackSets.
3. Select the AWSControlTowerBP-BASELINE-SERVICE-LINKED-ROLE StackSet.
4. On the Actions menu, choose Add stacks to stack set.
5. Under Set deployment options, choose Import stacks to stack set.
6. Under Stacks to import, enter the stack ID or Amazon Resource Name (ARN) of the stack that you created earlier. For example, enter StackSet-AWSControlTowerBP-BASELINE-SERVICE-LINKED-ROLE-#####.
7. Choose Next, review the options, and then choose Submit.

For more information, see Self-managed stack import for CloudFormation StackSets.

Retry the AWS Control Tower landing zone update

Update your landing zone, or enroll your account again in AWS Control Tower.

Related information

Import AWS resources into a CloudFormation stack

Managing stacks across accounts and Regions with StackSets

AWS::IAM::ServiceLinkedRole