Scripted Removal of AWS Control Tower Managed Accounts

Question

I can use the AWS Control Tower account factory API to provision new managed AWS accounts.  I also need to be able to delete AWS accounts with code when they are no longer required.  Is there a solution for bulk deleting Control Tower managed AWS accounts without having to log in to each account as the root user and close it?

Accepted Answer

Yes you can do this.  If you do not unmanage the account before you close it, you must delete the account's provisioned product in AWS Service Catalog after those 90 days are finished.

From https://docs.aws.amazon.com/controltower/latest/userguide/delete-account.html

```
You can close your AWS Control Tower member accounts from your organization’s management account without a requirement to sign in to each member account individually with root credentials, by means of AWS Organizations. You cannot close your management account in this way, however.

When you call the AWS Organizations CloseAccount API, or close an account in the AWS Organizations console, the member account is isolated for 90 days, as any AWS account would be. The account shows a Suspended status in AWS Control Tower and AWS Organizations. If you attempt to work with the account during that 90 days, AWS Control Tower gives an error message.
```

Please see the CloseAccount API Reference here

https://docs.aws.amazon.com/organizations/latest/APIReference/API_CloseAccount.html

Scripted Removal of AWS Control Tower Managed Accounts

Relevant questions

Issue building Control tower landing zone on a new account - AWS Control Tower setup failed. Be sure your account is subscribed to the AWS EC2 service, then try again

Scripted Unmanage of Control Tower Managed AWS Accounts prior to Closing

Enrolling existing AWS accounts in new OU

Control Tower / Account Factory / Email Validation