- Newest
- Most votes
- Most comments
You are able to use an Identity Center directory from another region with CodeCatalyst, although it does call out that this may add additional latency/connectivity issues. https://docs.aws.amazon.com/codecatalyst/latest/adminguide/setting-up-federation.html
If you changed the region your Identity Center is running in while you had Control Tower deployed, it will now be in a state of drift. In order to change your Identity Center region, you must decommission your Control Tower landing zone, and re-deploy to a new home region. This can't be edited in an existing deployment. You'll want to use this process, along with the additional CLI step noted for deploying to a new region afterward: https://docs.aws.amazon.com/controltower/latest/userguide/how-to-decommission.html
If you have any production workload running in this Organization, I would recommend opening a ticket with AWS Support to assist and ensure you perform the proper steps in order.
The situation you're facing is complex and stems from changing the region of your IAM Identity Center after setting up Control Tower in a different region. Unfortunately, Control Tower is tightly integrated with IAM Identity Center and expects it to be in the same region as the Control Tower home region.
To resolve this issue, you'll need to take the following steps:
-
First, you'll need to clean up the partially deployed Control Tower resources in us-east-1. This may involve manually deleting resources that Control Tower created, such as S3 buckets, CloudFormation stacks, and potentially AWS accounts.
-
You can use AWS CLI commands to help identify and delete these resources. For example, you can list CloudFormation stacks and delete them, or list and remove S3 buckets associated with Control Tower.
-
Once you've cleaned up the resources in us-east-1, you should be able to start fresh with a new Control Tower setup.
-
Before setting up Control Tower again, you'll need to decide which region you want as your home region. If you need CodeCatalyst with SSO login, and it's only supported in us-west-2, you may want to consider setting up Control Tower in us-west-2 as your new home region.
-
Ensure that your IAM Identity Center is set up in the same region where you plan to deploy Control Tower.
-
After cleanup and preparation, you can attempt to set up Control Tower again in your chosen home region.
If you encounter difficulties during this process or are unsure about how to proceed, it's advisable to contact AWS Support. They can provide guidance specific to your account and help ensure a smooth transition.
Remember, when setting up Control Tower, it's crucial to choose the correct home region initially, as changing it later can lead to complications like the one you're experiencing.
Sources
Remove partially deployed Control Tower Landing Zone | AWS re:Post
Switching AWS Regions - AWS IAM Identity Center
Regional differences for AWS Control Tower functionality - AWS Control Tower
answered 2 years ago
Relevant content
asked 2 years ago
asked 4 years ago
- AWS OFFICIALUpdated 6 months ago
- AWS OFFICIALUpdated 4 months ago
