How to clean-up a failed deployment of the Control Tower landing zone?

To clean up a failed deployment of AWS Control Tower landing zone, you'll need to follow these steps:

1. Clean up failed CloudFormation stacks:

• Navigate to CloudFormation in the AWS Console
• Look for stacks with names like AWSControlTowerBP-* and delete any that failed or are stuck

2. Remove leftover resources:

• Delete S3 buckets with names like aws-controltower-logs-* or aws-controltower-s3-access-logs-*
• Delete CloudWatch log groups like aws-controltower/CloudTrailLogs

3. Remove any manually created roles:

• If you created an AWSControlTowerAdmin role manually, you'll need to remove it as Control Tower needs to create this role itself

4. Clean up additional resources:

• Check for and delete any EventBridge rule called AWSControlTowerManagedRule
• You may need to remove or rename the Security and Sandbox organizational units if they were created

5. Disable AWS service access (if needed):

• If you want to set up a new landing zone in a different region, run this CLI command: aws organizations disable-aws-service-access --service-principal controltower.amazonaws.com

6. Start fresh:

• After cleaning up, return to AWS Control Tower and start the setup process again
• Make sure to use the correct home region and configuration settings
• Let Control Tower create all roles and resources automatically

If you encounter persistent issues, you may want to contact AWS Support for additional assistance with the cleanup process.
Sources
Remove partially deployed Control Tower Landing Zone | AWS re:Post
Control Tower set up landing zone problem | AWS re:Post
Manual cleanup tasks required after decommissioning - AWS Control Tower
How to decommission a landing zone - AWS Control Tower