Unable to Create Account in Control Tower – Email Conflict + Cannot Reset/Delete Control Tower Setup

Hi Chinnayya,
I understand that the provisioned product doesn't exist because the account was never provisioned. At this point, the only solution is to decommission the existing Control Tower Landing Zone setup. Once decommissioned, you can retry the Landing setup by using a different/new email address for your security accounts (Audit/Log archive accounts).

Regarding your question:
"How to proceed if the provisioned product was never successfully created?"

Unfortunately, since the provisioned product was never created, the only option is to decommission the existing Control Tower Landing Zone setup and initiate a new LZ setup with a different/new email address that isn't currently associated with any AWS accounts.

"Is there a way to reset the setup or unlock the email field for editing?"

Unfortunately, there's no direct way to unlock the email field in the backend. Retrying the Control Tower Setup would result in the same error.

To resolve this Control Tower Setup issue, follow these steps:

Execute the following CLI command to identify existing landing zones: (Use either AWS CLI or CloudShell in the region where you attempted to deploy the Control Tower Landing Zone)

aws controltower list-landing-zones

Initiate landing zone removal:

aws controltower delete-landing-zone --landing-zone-id <identifier>

Verify the operation status:

aws controltower get-landing-zone-operation --operation-identifier <identifier>

Reference Documentation:
list-landing-zones: https://awscli.amazonaws.com/v2/documentation/api/latest/reference/controltower/list-landing-zones.html
delete-landing-zone:
https://awscli.amazonaws.com/v2/documentation/api/latest/reference/controltower/delete-landing-zone.html
get-landing-zone-operation:
https://awscli.amazonaws.com/v2/documentation/api/latest/reference/controltower/get-landing-zone-operation.html

Note:

• The decommissioning process can take up to 2 hours to complete
• Ensure there are no leftover resources from the previous AWS Control Tower Landing Zone
• After the waiting period, initiate a new Landing Zone setup using new email addresses
• Not all resources removed during the decommission, make sure to manually cleanup the resources which are removed, refer the below docs for more information.

Additional Resources:
Decommission an AWS Control Tower Landing Zone:
https://docs.aws.amazon.com/controltower/latest/userguide/decommission-landing-zone.html How to Decommission a LandingZone:
https://docs.aws.amazon.com/controltower/latest/userguide/how-to-decommission.html
Manual Cleanup Tasks Required After Decommissioning:
https://docs.aws.amazon.com/controltower/latest/userguide/manual-cleanup-required.html
Resources Not Removed During Decommissioning:
https://docs.aws.amazon.com/controltower/latest/userguide/resources-not-removed.html \

Hello Chinnayya, I understand you're experiencing issues with AWS Control Tower Landing Zone setup where account creation is failing due to an existing email address. Here's how to resolve this:

1. Resolution Steps:

   • First, check your Service Catalog provisioned product status
   • If you see an error state, you'll need to terminate the failed provisioning

2. You can terminate the provisioned product in two ways:

   Option 1: Using AWS Console

   • Navigate to AWS Service Catalog
   • Locate the failed provisioned product
   • Select and terminate it [Console Guide: https://docs.aws.amazon.com/servicecatalog/latest/userguide/enduser-delete.html] Note: * While deleting the provisioned product from console, select "Ignore errors" option as soon as you click on terminate option. If you select this option, ServiceCatalog stops managing the provisioned product even if it cannot delete the product's underlying resources.*

   Option 2: Using AWS CLI (via CloudShell)

   • Use the terminate-provisioned-product command [CLI Reference: https://docs.aws.amazon.com/cli/latest/reference/servicecatalog/terminate-provisioned-product.html]

3. After successful termination:

   • Restart the landing zone setup process (Click on ‘Retry’ button on red flag pop-up on control tower dashboard)
   • Use a different email address for the account creation
   • Complete the remaining setup steps

Note: Ensure the new email address you use isn't associated with any existing AWS account. Let me know if you need any clarification on these steps!

You CANNOT reuse that email again in Account Factory, AWS strictly blocks it if it’s already tied to a standalone AWS account. Use a different email, or an alias like yyyyy@domain.com. This works 100% and lets you proceed with Account Factory again. Retry the Account Creation, Once you use a valid, unused email, you can successfully create a new account from Account Factory.

• • • The only guaranteed way to fix it is:**

1. Open a high-severity AWS Support case.

2. Request a manual teardown of the landing zone and/or cleanup of the failed account creation.

3. AWS Support can force-delete the setup and let you restart clean.

They’ve done this for others in similar situations. It’s not self-service, but it’s effective and absolutely the cleanest solution if you're stuck.

Note: Unfortunately, there’s no direct way to “delete” a failed account creation from the Account Factory UI. If the workflow is stuck, you’ll again need to involve Support, they can help clean up stale provisioning artifacts.