Skip to content

ControlTower error after changing the region.

0

I have a ControlTower setup on us-east-1 (Home region). But I want to configure CodeCatalyst with SSO login. It seems that CodeCatalyst is only supported on us-west-2 and the IAM Identity Center should also be at us-west-2. So I changed IAM Identity Center to us-west-2 successfully. But now I cannot access the ControlTower anymore. I get the following error when trying to access it on us-east-1: 'Error AWS Control Tower failed to set up your landing zone completely: IAM Identity Center is already enabled in a different region.' How can I reset ControlTower (or transfer it to us-west-2) if I am not able to acces it? There is an option to Retry in us-east-1, I can modify some parameters but the Home Region is fixed in us-east-1.

Please assist

2 Answers
0

You are able to use an Identity Center directory from another region with CodeCatalyst, although it does call out that this may add additional latency/connectivity issues. https://docs.aws.amazon.com/codecatalyst/latest/adminguide/setting-up-federation.html

If you changed the region your Identity Center is running in while you had Control Tower deployed, it will now be in a state of drift. In order to change your Identity Center region, you must decommission your Control Tower landing zone, and re-deploy to a new home region. This can't be edited in an existing deployment. You'll want to use this process, along with the additional CLI step noted for deploying to a new region afterward: https://docs.aws.amazon.com/controltower/latest/userguide/how-to-decommission.html

If you have any production workload running in this Organization, I would recommend opening a ticket with AWS Support to assist and ensure you perform the proper steps in order.

AWS
EXPERT

answered 2 years ago

-1

The situation you're facing is complex and stems from changing the region of your IAM Identity Center after setting up Control Tower in a different region. Unfortunately, Control Tower is tightly integrated with IAM Identity Center and expects it to be in the same region as the Control Tower home region.

To resolve this issue, you'll need to take the following steps:

  1. First, you'll need to clean up the partially deployed Control Tower resources in us-east-1. This may involve manually deleting resources that Control Tower created, such as S3 buckets, CloudFormation stacks, and potentially AWS accounts.

  2. You can use AWS CLI commands to help identify and delete these resources. For example, you can list CloudFormation stacks and delete them, or list and remove S3 buckets associated with Control Tower.

  3. Once you've cleaned up the resources in us-east-1, you should be able to start fresh with a new Control Tower setup.

  4. Before setting up Control Tower again, you'll need to decide which region you want as your home region. If you need CodeCatalyst with SSO login, and it's only supported in us-west-2, you may want to consider setting up Control Tower in us-west-2 as your new home region.

  5. Ensure that your IAM Identity Center is set up in the same region where you plan to deploy Control Tower.

  6. After cleanup and preparation, you can attempt to set up Control Tower again in your chosen home region.

If you encounter difficulties during this process or are unsure about how to proceed, it's advisable to contact AWS Support. They can provide guidance specific to your account and help ensure a smooth transition.

Remember, when setting up Control Tower, it's crucial to choose the correct home region initially, as changing it later can lead to complications like the one you're experiencing.

Sources
Remove partially deployed Control Tower Landing Zone | AWS re:Post
Switching AWS Regions - AWS IAM Identity Center
Regional differences for AWS Control Tower functionality - AWS Control Tower

answered 2 years ago

You are not logged in. Log in to post an answer.

A good answer clearly answers the question and provides constructive feedback and encourages professional growth in the question asker.