AWS ControlTower unmange account action failed with error: AWS Control Tower could not enroll your account
Background: AWS Control Tower was deployed in an existing AWS Organization with 100s of AWS account. The AWSControlTowerExecution role was rolled out in bulk using AWS CloudFormation stackset in default settings (using the service managed role) to enroll existing account.
Post enrollment, following the steps to close an AWS account failed during the CT's unmanage stage. The error from the control tower's console is as below:
AWS Control Tower could not enroll your account for the following reason: AWS Control Tower cannot perform a stack set operation on a stack instance for the following reason: StackSet Id: AWSControlTowerBP-BASELINE-CONFIG:xxaadd-qqqq-zzzz-vvvv, Stack instance Id: arn:aws:cloudformation:<aws-region-code>:<account-id>:stack/StackSet-AWSControlTowerBP-BASELINE-CONFIG-ddfgghh/eerrtttygh, Status: INOPERABLE, Status Reason: Account <account-id> should have 'AWSControlTowerExecution' role with trust relationship to Role 'service-role/AWSControlTowerStackSetRole'.
Troubleshooting:
- Prior to unmanaging; confirmed that the roles i.e.
AWSControlTowerStackSetRolein the management account andAWSControlTowerExecutionexist in the child account with correct trust relationship settings - Tested manually deleting a stack instance from the stackset
AWSControlTowerBP-BASELINE-CONFIGin the management/root payer account. It completed successfully. - AWS CloudTrail showed that the role
AWSControlTowerExecution, was being deleted by a stack delete operation
Solution:
Turns out the root cause was the default CloudFormation settings while deploying the stacksets for rolling out the AWSControlTowerExecution role from the management account. The role AWSControlTowerExecution was being deleted when ControlTower moves the account to the root of the Organization as a part of the unmanage operation. Deleting the stackinstance when moved from the initial target OU is the default setting with CF stacksets.
- Identified the original stackset and 'Edit automatic deployment'. Set Account removal behavior to retain the stack
- Recreated the AWSControlTowerExecution role manually in the failed account and retried the unmanage to complete successfully.
- Topics
- Management & Governance
- Language
- English
asked 10 months ago275 views
- Newest
- Most votes
- Most comments
The error you're encountering during the AWS Control Tower unmanage account action is related to the trust relationship configuration between the AWSControlTowerExecution role in the child account and the AWSControlTowerStackSetRole in the management account.
When AWS Control Tower attempts to unmanage an account, it needs to perform stack operations on the AWSControlTowerBP-BASELINE-CONFIG stack set. However, the operation is failing because the AWSControlTowerExecution role in the target account doesn't have the proper trust relationship with the service-role/AWSControlTowerStackSetRole in the management account.
Your troubleshooting steps were on the right track. You identified that the AWSControlTowerExecution role was being deleted during the stack delete operation. This is happening because when you originally deployed the CloudFormation StackSet to create the AWSControlTowerExecution role across your accounts, you used the default "Delete stacks" setting for account removal behavior.
Your solution is correct. By editing the automatic deployment settings of the original StackSet that deployed the AWSControlTowerExecution role and changing the "Account removal behavior" from "Delete stacks" (default) to "Retain stacks," you ensure that the AWSControlTowerExecution role remains in the account even when the account is removed from the StackSet's target accounts. This allows AWS Control Tower to complete its unmanage process successfully.
This approach is particularly important in environments where AWS Control Tower was deployed to an existing AWS Organization with many accounts, as it ensures the proper sequence of operations when managing and unmanaging accounts.
Sources
Troubleshoot AWS Control Tower role error | AWS re:Post
Unenroll an account - AWS Control Tower
That error means Control Tower couldn’t assume the AWSControlTowerExecution role in the target account because the role’s trust relationship doesn’t point to the service-role/AWSControlTowerStackSetRole in the management account. When the role is deployed through a StackSet using service-managed permissions, CloudFormation automatically creates a service-managed execution role for StackSets, not the Control Tower one. As a result, accounts enrolled that way appear to have the right role name but lack the correct principal in the trust policy, causing stack instance operations to fail with “INOPERABLE” status.
—Taz
answered 10 months ago
Relevant content
asked 4 years ago
asked 3 years ago
