AWS Builder Center is the official home for builders on AWS. Share and read what others are working on, follow people who inspire you, explore training and workshops, and find tools to support what you're building.
Merging two organizations, how to remove Log Archive account from an organization?
I am merging two Orgs. I have migrated all sub accounts from Org 'B' to Org 'A', except for Log Archives and the Root account itself. So I'm familiar with the process. However I can't seem to figure out why I can't remove the Log Archive account. I'm thinking its a Control tower issue. I get the following error but I believe its a red herring.
"You cannot remove a delegated administrator from the organization without de-registering the account."
There is nothing to deregister in either account. I even tried moving the Log Archive account out of the Security OU in the management account. That didn't change the error.
What is the process for removing the Log Archive account from an Org?
- Newest
- Most votes
- Most comments
The LogArchive comes from a Control Tower setup. It's not a default component of AWS Organizations. To de-register a Log Archive account from AWS Organizations you cannot directly remove it from AWS Organizations or not even AWS Control Tower from the Control Tower console, but you would need to decommission your entire landing zone within Control Tower, as the Log Archive account is considered a shared account created by Control Tower and is tied to the Security OU within your organization structure; essentially, removing the Control Tower management from your accounts, including the Log Archive account, which would then remain in your organization as a standard AWS account that you can manage independently.
See the resources below for your reference, which will help you address your issue.
https://docs.aws.amazon.com/controltower/latest/userguide/decommission-landing-zone.html https://docs.aws.amazon.com/controltower/latest/userguide/unmanage-account.html# https://docs.aws.amazon.com/controltower/latest/userguide/resources-not-removed.html#
If the issue persists, you can create an AWS support ticket to address this issue.
Relevant content
asked a year ago
asked 2 years ago
asked 3 years ago
- AWS OFFICIALUpdated 4 years ago
Thank you, this looks like exactly what I needed. I will test this out and come back and accept this as the answer if it works. Which I'm sure it will.
Sorry it took so long, but we hit some snags. Your answer was part of the solution. We removed the Control Tower Landing zone. However we still couldn't remove the Log Archive account. We had to deregister Guard Duty.
From the Org root we ran: aws organizations list-delegated-services-for-account --account-id <Log Archive ID>
This showed: { "DelegatedServices": [ { "ServicePrincipal": "guardduty.amazonaws.com", "DelegationEnabledDate": "2023-10-04T19:14:48.560000+00:00" } ] }
Then we ran: aws organizations deregister-delegated-administrator --account-id <Log Archive ID> --service-principal guardduty.amazonaws.com
This finally allowed us to remove the Log Archive account. So its a combination of Control Tower Landing Zone and Guard Duty.