We cannot use AWS Control Tower Account Factory in GovCloud LZA env?

Question

Hi all

I'm deploying "Landing Zone Accelerator on AWS" following https://docs.aws.amazon.com/solutions/latest/landing-zone-accelerator-on-aws/option-2-deploy-on-new-aws-govcloud-us-accounts.html#step-2-use-aws-service-catalog-to-launch-the-product in a US GovCloud. Here if we want to create a new account, we create the account first, then invite the account into the GovCloud organization and enroll it into AWS Control Tower in the GovCloud, which means we do not use AWS Control Tower Account Factory. Is this the only way to create a new account in the LZA GovCloud environment? We cannot use AWS Control Tower AF, AFC, or AFT in the GovCloud?

Thanks.

Makendran G · Accepted Answer

You are correct in your understanding of the account creation process for AWS GovCloud (US) when using the Landing Zone Accelerator (LZA) on AWS. The process you described is indeed the recommended approach for creating new accounts in the LZA GovCloud environment.

AWS Control Tower Account Factory, AFC, and AFT are not available in GovCloud, necessitating this manual approach to account creation and enrollment.

[+] AWS Control Tower User Guide: https://docs.aws.amazon.com/controltower/latest/userguide/region-how.html

Adam · Answer

It is my understanding that if the account is not created by the organization then the invite and acceptance must be done manually because there is a role that is used to accept the invitation which is not automatically created for invited accounts.
Here is a doc covering the difference between created and invitied accounts --> https://docs.aws.amazon.com/organizations/latest/userguide/orgs_manage_accounts_access.html#orgs_manage_accounts_create-cross-account-role

Hope this helps!

We cannot use AWS Control Tower Account Factory in GovCloud LZA env?

Relevant content