Skip to content

Setting up Centralised Backups when using TSE-SE LZA

0

Hi, We are trying to set up Central Backups in our org as per the guidance, https://aws.amazon.com/blogs/storage/build-centralized-cross-region-backup-architecture-with-aws-control-tower/

We've used TSE-SE LZA version 1.11.0-a aws-samples/landing-zone-accelerator-on-aws-for-tse-se at release/v1.11.0-a

We've set up Central Backup account and Backup Administrator accounts via Control Tower. We have managed to complete step 4, however when we try to enable backups for each OU, we are getting the following error,

“AWS Control Tower could not apply Service Control Policies for organizational unit <ou> because the OU has maximum number of SCPs. To continue, delete some existing policies or combine them.”

Here are the SCPs that are attached to our Security OU,

• AWSAccelerator-Guardrails-Part-1 • aws-guardrails-GZpdKg – “This policy and the contents implement controls, managed by AWS Control Tower. Do not modify, delete, or detach this policy from any target, or attach it to any target, with the AWS Organizations console or APIs. To modify these controls, you must utilize AWS Control Tower.” • AWSAccelerator-Guardrails-Part-0-Core • aws-guardrails-rvZyuy - “This policy and the contents implement controls, managed by AWS Control Tower. Do not modify, delete, or detach this policy from any target, or attach it to any target, with the AWS Organizations console or APIs. To modify these controls, you must utilize AWS Control Tower.” • FullAWSAccess – listed twice

Has anyone who are using TSE-SE LZA be able to set up CentralBackup, DataBunker and BackupAdministrator Accounts and enable Backup Service? If so, appreciate any pointers to overcome this issue.

1 Answer
0

I have replicated your scenario of setting up centralized backups following the same AWS guidance (https://aws.amazon.com/blogs/storage/build-centralized-cross-region-backup-architecture-with-aws-control-tower/) in my environment where LZA was already deployed.

My Implementation Steps:

Created backup administrator account through AWS Organizations (not Control Tower) Created central backup account through AWS Organizations (not Control Tower) Created multi-region KMS key as documented Updated Landing Zone Accelerator with enable backup option Enabled AWS Backup without any issues.

However, I notice you mentioned creating accounts via Control Tower. It's not recommended to create backup administrator and central backup accounts through Control Tower - they should be created through AWS Organizations directly.

For Your SCP Limit Issue:

From your error I can see that you have hit the maximum number of SCPs that has been attached to OU.

https://docs.aws.amazon.com/organizations/latest/userguide/orgs_reference_limits.html#min-max-policies

I would recommend you to check number of SCP's attached to your OU's .

Moreover, I don't have access to resources that is attached to you OU. I would recommend you to open a case with AWS Support to assist you better.

Sources
Build centralized cross-Region backup architecture with AWS Control Tower | AWS Storage Blog
Enable backups - AWS Control Tower
Enable backup on moved accounts - AWS Control Tower

answered 10 months ago

AWS
SUPPORT ENGINEER

revised 10 months ago

AWS
SUPPORT ENGINEER

revised 10 months ago

You are not logged in. Log in to post an answer.

A good answer clearly answers the question and provides constructive feedback and encourages professional growth in the question asker.