Getting "Error AWS Control Tower encountered an error when retrieving the AWS Region configuration" when trying to reset Control Tower version 3.2

Question

Dear Team,

As the title, now I'm getting issue when trying to rết Control Tower version 3.2. Our control tower is getting drift after we updated SCP Customer Managed guard rail. 
Please kindly help to support us. Thank you very much!

TA · Accepted Answer

The answer is because lack of permission to reset and updating landing zone. That's all.

re:Post Agent · Answer

The error you're encountering when trying to reset AWS Control Tower version 3.2 is likely related to configuration issues that are causing drift in your Control Tower environment.

Based on similar issues, here are some steps you can take to resolve this problem:

1. First, check for any failed CloudFormation stacks related to Control Tower. Look for stacks with names like "AWSControlTowerBP-*" and delete any that failed or are stuck.

2. Look for leftover resources that might be causing conflicts, such as:
- S3 buckets with names like "aws-controltower-logs-*" or "aws-controltower-s3-access-logs-*"
- CloudWatch log groups like "aws-controltower/CloudTrailLogs"

3. If you have AWS Config issues, you may need to clean up configuration recorders and delivery channels. You can use these AWS CLI commands:
- To view: `aws configservice describe-configuration-recorders` and `aws configservice describe-delivery-channels`
- To delete: First stop the recorder with `aws configservice stop-configuration-recorder`, then delete with the appropriate delete commands

4. If you've made changes to IAM Identity Center (formerly SSO) configuration or regions, this could be causing conflicts with Control Tower. Control Tower expects IAM Identity Center to be in the same region as your Control Tower home region.

5. Check for any custom policies attached to permission sets in IAM Identity Center that might be conflicting with Control Tower's requirements.

If these steps don't resolve the issue, you might need to perform a more thorough cleanup of Control Tower resources before attempting to reset it again. In complex cases, contacting AWS Support is recommended, especially if you have production workloads running in the organization.  
**Sources**  
[ControlTower error after changing the region. | AWS re:Post](https://repost.aws/questions/QUEkuUJBX_RLq87IRbXsGUWA/controltower-error-after-changing-the-region)  
[Issue with Governing Multiple AWS Regions Using Control Tower | AWS re:Post](https://repost.aws/questions/QUhhmtbiktQoqTKgzn0LQxcQ/issue-with-governing-multiple-aws-regions-using-control-tower)  
[Control Tower set up landing zone problem | AWS re:Post](https://repost.aws/questions/QUF6oc0dLrTwKmtKLyjwomBw/control-tower-set-up-landing-zone-problem)  
[Control Tower Account Enrollment Error | AWS re:Post](https://repost.aws/questions/QUxDtFpeK0RouA7FCU2OuZBA/control-tower-account-enrollment-error)

Getting "Error AWS Control Tower encountered an error when retrieving the AWS Region configuration" when trying to reset Control Tower version 3.2

Add your answer

Relevant content