- Newest
- Most votes
- Most comments
This problem can't be solved by CLI commands or through the console. Solution is to open Support Case, provide all details and wait until internal support team fix the metadata. Then I was able to complete the removal of Landing Zone and setted up it again.
answered a year ago
What you'll probably have to do here is go into your Control Tower management account and go to your CloudFormation StackSets. You'll then want to find the baseline for AWS Backup that you're trying to delete and open it up. Go into the 'Stack Instances' for the Stackset and select Actions -> Delete Stacks from Stackset. Then, for the deployment target, enter the OU ID (ie. ou-abc123) of the OU that you had previously deleted, OR specify the account numbers that were in that OU that are listed on that stacks page.
Ensure that you select "Retain stacks" on that page as well since the actual stack deletion will probably fail in this case.
Once that is done, you should be able to try resetting your landing zone again and the decommissioning.
This is a challenging situation that can occur when changes are made outside of AWS Control Tower's management. When you removed the OU with enabled AWS Backup, it created a discrepancy in Control Tower's metadata, leading to the issues you're experiencing.
To resolve this, you'll need to follow these steps:
-
First, try to disable the AWS Backup baseline from all OUs before attempting to turn off AWS Backup for your landing zone. You can do this by using the DisableBaseline API for each OU that has backups enabled.
-
If you're unable to disable the baseline due to the "Unauthorized" error, it's likely because the OU no longer exists, but Control Tower still has a reference to it.
-
In this case, you may need to reset your landing zone. However, before you can do that, you need to ensure that the Security OU is present and contains the Log Archive and Audit accounts. If you've moved these accounts, move them back to the Security OU.
-
Once the Security OU is properly set up, you should be able to access the Landing zone settings page in the AWS Control Tower console and use the Reset button.
-
If you're still unable to access the Landing zone settings page, you may need to contact AWS Support for assistance in manually resetting your landing zone or cleaning up the metadata references to the deleted OU.
Remember, it's important to manage resources within AWS Control Tower to avoid these types of conflicts. Making changes outside of Control Tower, such as deleting OUs or moving critical accounts, can lead to drift and require more complex resolution processes.
If these steps don't resolve your issue, you may need to engage AWS Support for further assistance, as they might need to intervene at the backend to clean up the lingering metadata references to the deleted OU with enabled AWS Backup.
Sources
Turn off backups - AWS Control Tower
If you manage resources outside of AWS Control Tower - AWS Control Tower
Considerations for controls and OUs - AWS Control Tower
answered a year ago
I reset Landing Zone several times, it doesn't update Control Tower metadata. When I try to turn off AWS Backup during this process, it refers to non-existing OU and process failed.
Relevant content
asked 3 years ago
asked 10 months ago
asked 17 days ago
- AWS OFFICIALUpdated 2 months ago
Thank you for the answer, but it doesn't help. I followed your steps, but if I provided removed OU path as deployment target (ou-1234-abcdefgh) wizards says that path doesn't exist. It looks like it checks for accounts inside provided OU. But in any case, that OU doesn't exist. Also I removed deployed Control Tower Backup stacks from Central Backup and Admin Backup accounts, but it doesn't solve issue. When I retry decommision the landing zone, I've got the same error message.
Did you try the option of targeting the specific account numbers as well?