Cannot deselect the opt-in regions during Control Tower setting up process

Question

I chose 2 opt-in goverence regions when i was tring to set up the landing zone via control tower, but it shows the error info: AWS Control Tower failed to set up your landing zone completely: the accounts must be allow-listed explicitly before AWS Control Tower can enable opt-in regions. Deselect the opt-in region and retry the operation, or add the account to the required allow-list.

I tried to deselect the opt-in region and retry again and again, this doesn't work, the setting will maintain all the region i have selected before and keep all hostorically added regions. Is it a system bug?

re:Post Agent · Answer

This situation you're experiencing is not a system bug, but rather a limitation in how AWS Control Tower handles opt-in regions during the landing zone setup process.

When you initially select opt-in regions during the landing zone setup, AWS Control Tower remembers these selections. Even if you try to deselect them later in the process, the system maintains the history of your previous selections. This behavior is by design to ensure consistency and prevent accidental removal of governance from regions you initially intended to include.

The error message you're seeing indicates that your AWS account needs to be explicitly allowed to use these opt-in regions before AWS Control Tower can enable them. This is a security measure implemented by AWS for opt-in regions, which have higher security requirements than standard commercial regions.

To resolve this issue, you have a couple of options:

1. Contact AWS Support to have your account added to the required allow-list for the opt-in regions you want to use. Once your account is allow-listed, you should be able to proceed with the landing zone setup including those regions.

2. If you don't actually need to govern these opt-in regions immediately, you could try setting up your landing zone without selecting any opt-in regions initially. After the landing zone is successfully set up, you can then update it to include the opt-in regions once your account has been properly allow-listed.

Remember, it's generally recommended to only select regions where you actually plan to host AWS resources or workloads. Opting out of a region doesn't prevent you from deploying resources there, but those resources will remain outside of AWS Control Tower governance.

If you continue to experience issues after trying these approaches, it would be advisable to reach out to AWS Support for further assistance, as they can provide more specific guidance based on your account's status and requirements.  
**Sources**  
[Considerations for activating AWS opt-in Regions - AWS Control Tower](https://docs.aws.amazon.com/controltower/latest/userguide/opt-in-region-considerations.html)  
[How AWS Regions Work With AWS Control Tower - AWS Control Tower](https://docs.aws.amazon.com/controltower/latest/userguide/region-how.html)  
[Customize your AWS Control Tower landing zone - AWS Control Tower](https://docs.aws.amazon.com/controltower/latest/userguide/customize-landing-zone.html)

Cannot deselect the opt-in regions during Control Tower setting up process

Add your answer

Relevant content