Control Tower Account Enrollment Error

The error you're encountering suggests that there's a conflict between a policy attached to permission sets in AWS IAM Identity Center (formerly AWS SSO) and AWS Control Tower's requirements for account enrollment.

Even though you didn't find anything in policy ZZZ that seems to explicitly block Control Tower, the service is indicating that this policy is not supported for accounts managed by Control Tower. This could be due to permissions that Control Tower needs to manage the account effectively, which might be restricted by the policy in question.

To resolve this issue, you should:

1. Access the AWS IAM Identity Center console.
2. Review the permission sets attached to AWS Control Tower managed accounts.
3. Identify which permission sets have the policy ZZZ attached.
4. Detach the policy ZZZ from these permission sets.

After detaching the policy, try enrolling the account again in AWS Control Tower. If the issue persists, you may need to review other policies attached to the permission sets to ensure they don't conflict with Control Tower's requirements.

It's important to note that AWS Control Tower needs certain permissions to manage accounts effectively, and some custom policies might interfere with its operations. When using custom policies with Control Tower-managed accounts, it's crucial to ensure they don't restrict Control Tower's ability to perform its management functions.

If you continue to face issues after detaching the policy, you may want to consult AWS Support or review the AWS Control Tower documentation for any specific requirements or known conflicts with custom policies in IAM Identity Center.
Sources
Working with AWS IAM Identity Center and AWS Control Tower - AWS Control Tower
Using identity-based policies (IAM policies) for AWS Control Tower - AWS Control Tower

Is the ZZZ policy that it's referencing attached to one of the AWS managed permission sets? (ie. AWSAdministratorAccess) Also, have you created that custom policy already in the account that you're trying to enroll per the "Customer managed policies" instructions listed here: https://docs.aws.amazon.com/singlesignon/latest/userguide/permissionsetcustom.html#permissionsetscmpconcept

Control Tower is attempting to create a new Identity Center administrative user upon enrollment of a new account (user may already exist and it's just adding the permission set for this new account).

If the policy is attached to AWSAdministratorAccess specifically, I would detach it and then try re-enrolling (assuming you already verified that it was created as a custom policy within the account as outlined above).