Error while decommissioning Control Tower

This error occurs because AWS Control Tower is unable to complete the decommissioning process due to issues with role permissions and suspended accounts.

The specific problem is that the AWSControlTowerAdmin role in your management account cannot assume the AWSControlTowerExecution role in one of your child accounts (797639046587). This is likely related to your Log Archive and Audit accounts being in SUSPENDED status.

When accounts are suspended, the IAM roles within them become inaccessible, which breaks the trust relationship needed for Control Tower operations. Control Tower requires these accounts to be active during the decommissioning process.

To resolve this issue, you have a few options:

1. Reactivate the suspended accounts (Log Archive and Audit) if possible, then try decommissioning again.

2. If you cannot reactivate the accounts, you'll need to open a support case with AWS. Explain the situation with your suspended accounts and the decommissioning error. AWS Support can help fix the Control Tower metadata or manually assist with the decommissioning process.

3. As a last resort, you might need to manually clean up resources after a failed decommissioning attempt, including:

• Removing any failed CloudFormation stacks with names like AWSControlTowerBP-*
• Deleting S3 buckets related to Control Tower (aws-controltower-logs-*)
• Removing CloudWatch log groups like aws-controltower/CloudTrailLogs

The suspended status of your foundation accounts is the root cause of this issue, as Control Tower needs to access these accounts during the decommissioning process.
Sources
Removed OU with enabled AWS Backup blocks any operations on Control Tower's Landing Zone | AWS re:Post
Control Tower set up landing zone problem | AWS re:Post
Manual cleanup tasks required after decommissioning - AWS Control Tower

have raised the case to reopen the accounts and awaiting their reply. is there no other WAY to force the deletion of suspended accounts? THis is really wierd AWS keeping control of customer's accounts and forcing us to raise the incidents even for smallest things. AZURE is much way better in giving control to customers and quotas etc