Landing zone drift detection error

Question

After a restructuring in ten OUs from aws organizations, we seem to have lost access to controltower.

As we understand by reviewing the documentation, the problem is a d-sync between controltower and the organization.

"Renaming, deleting, and moving resources outside of the AWS Control Tower console causes the console to become out of sync. Many changes can be reconciled automatically. Certain changes require a reset to your landing zone, to update the information that's displayed in the AWS Control Tower console"

Error: Landing zone drift detected

The required OU, was deleted.

A managed SCP was attached, deleted, detached, or modified on the OU Core (xx). This action has compromised the shared accounts and their functionality. For example, the log archive and audit accounts may no longer be working because their permissions have changed.

Until you fix this problem, you cannot view or manage your AWS Control Tower landing zone. Provisioning new accounts is not recommended, because logging and auditing may not be functioning.
- https://docs.aws.amazon.com/controltower/latest/userguide/drift.html

1. The question is How safe is the "reset"? 
2. How to fix this issue?
3. Is there an alternative such as executing some type of rollback?

Sandisiwe_M · Answer

Hello,

I understand that your Landing Zone is drifted and you've lost access to Control Tower after restructuring 10 Organisational units from AWS organisations. You would therefore like to know how safe is the  Landing Zone "Reset" option, how you can fix this issue and if there's an alternative solution for this.

Please see below a summary of my answers to your questions

Question 1: How safe is the "reset" option

Please kindly be configure that resetting [1] a landing zone is generally considered a significant operation that is used in cases of severe drift and should be approached with caution.

Below are some of the things that you need to consider before reseting your Landing Zone:
- Backup all critical data and configurations before proceeding
- Plan for potential service interruptions

Basically the landing zone resets to its initial setup settings, correcting any drift, and does not alter the actual landing zone version.

NOTE:
If you are running AWS Control Tower landing zone version 3.1 and above, you can update or repair your landing zone in place on the current version, or you can upgrade to a version of your choice [2]

Question 2: How to fix the issue

Please kindly note that to resolve the type of drift mentioned above, it is necessary to run a Control Tower Landing Zone Reset or Update. Performing these actions will baseline the Landing Zone environment to ensure compliance with the environment settings, including having the correct SCPs enabled based on guardrails.

Please refer to the following document[1] for the steps that you can follow to reset the Landing Zone and resolve the drift.

Question 3: Is there an alternative such as executing some type of rollback?

The only option to fix this issue is the Reset option .

References:
[1] https://docs.aws.amazon.com/controltower/latest/userguide/lz-api-reset.html
[2] https://docs.aws.amazon.com/controltower/latest/userguide/2024-all.html#lz-version-select

Landing zone drift detection error

Add your answer

Relevant content