Control Tower enrollment keeps failing with InsufficientDeliveryPolicyException for AWS Config

This AWS Control Tower enrollment issue with the InsufficientDeliveryPolicyException error is related to AWS Config's inability to write to the designated S3 bucket. Based on your troubleshooting steps, here are some additional approaches to resolve this issue:

1. Check for existing AWS Config resources: Before enrollment, verify if there are any existing AWS Config configuration recorders or delivery channels in the account you're trying to enroll. If they exist, you'll need to delete them in all supported regions before attempting enrollment again. AWS Control Tower needs to create its own AWS Config resources during enrollment.

2. Verify the AWSControlTowerExecution role: Ensure this role exists in the account you're trying to enroll and has the correct trust relationship with the management account. The role should have the AdministratorAccess policy attached.

3. Check account placement: If the account is under a registered OU and enrollment is failing, try moving the account to the root level of your organization temporarily, then attempt enrollment again.

4. Review the provisioned product: If you've attempted enrollment before and it failed, there might be a partially completed process. Check the Service Catalog console for any failed provisioned products related to this account and terminate them before trying again.

5. Verify bucket permissions: While you've tried various bucket policy configurations, ensure that the bucket itself doesn't have any Block Public Access settings or other restrictions that might interfere with AWS Config's ability to write to it.

6. Check for service limits: Although less likely given the specific error, ensure your account has sufficient service limits for AWS Control Tower to operate properly.

Since you've already verified direct S3 write access from the target account, the issue might be related to how AWS Config specifically interacts with the bucket rather than general S3 permissions. The error suggests AWS Config is still unable to write to the bucket with the specified organization prefix despite your policy changes.
Sources
Troubleshooting - AWS Control Tower
Troubleshoot AWS Control Tower role error | AWS re:Post
ControlTower - Your existing service limits for this AWS account are not sufficient for AWS Control Tower to launch. | AWS re:Post

Hi There

Something is preventing config from writing to that bucket. Have you looked in CloudTrail to see exactly which api call is being denied, and the principal associated with it?

Did you enabled ObjectLock on the bucket or changed any other settings?

Do you have KMS enabled in Control Tower Settings?

Check your S3 bucket policy, should look something like

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Sid": "AllowSSLRequestsOnly",
            "Effect": "Deny",
            "Principal": "*",
            "Action": "s3:*",
            "Resource": [
                "arn:aws:s3:::aws-controltower-logs-1234567890-us-east-1",
                "arn:aws:s3:::aws-controltower-logs-1234567890-us-east-1/*"
            ],
            "Condition": {
                "Bool": {
                    "aws:SecureTransport": "false"
                }
            }
        },
        {
            "Sid": "AWSBucketPermissionsCheck",
            "Effect": "Allow",
            "Principal": {
                "Service": [
                    "config.amazonaws.com",
                    "cloudtrail.amazonaws.com"
                ]
            },
            "Action": "s3:GetBucketAcl",
            "Resource": "arn:aws:s3:::aws-controltower-logs-1234567890-us-east-1"
        },
        {
            "Sid": "AWSConfigBucketExistenceCheck",
            "Effect": "Allow",
            "Principal": {
                "Service": [
                    "config.amazonaws.com",
                    "cloudtrail.amazonaws.com"
                ]
            },
            "Action": "s3:ListBucket",
            "Resource": "arn:aws:s3:::aws-controltower-logs-1234567890-us-east-1"
        },
        {
            "Sid": "AWSBucketDeliveryForConfig",
            "Effect": "Allow",
            "Principal": {
                "Service": "config.amazonaws.com"
            },
            "Action": "s3:PutObject",
            "Resource": "arn:aws:s3:::aws-controltower-logs-1234567890-us-east-1/o-123abc/AWSLogs/*/*",
            "Condition": {
                "StringEquals": {
                    "aws:SourceOrgID": “o-123abc”
                }
            }
        },
        {
            "Sid": "AWSBucketDeliveryForOrganizationTrail",
            "Effect": "Allow",
            "Principal": {
                "Service": "cloudtrail.amazonaws.com"
            },
            "Action": "s3:PutObject",
            "Resource": [
                "arn:aws:s3:::aws-controltower-logs-1234567890-us-east-1/o-123abc/AWSLogs/1234567890/*”,
                "arn:aws:s3:::aws-controltower-logs-1234567890-us-east-1/o-123abc/AWSLogs/o-123abc/*”
            ],
            "Condition": {
                "StringEquals": {
                    "aws:SourceOrgID": “o-123abc”
                }
            }
        }
    ]
}