Partially failed Control Tower setup with an incomplete account

Hi all,

I have the following problem:

I have been dealing with a partially failed Control Tower setup with an incomplete account that can't be removed normally. The account is closed but I want to set up a new Landing zone using the root management account, but am unable to due to the ConstraintViolationException error occurring, which meant the landing zone failed to be set up. The account that was closed is incomplete and preventing cleanup, so as such can't be decommisioned due to this account status. I would love some help with the manual clean up of the failed Control Tower Landing Zone...

I have got Amazon Q to summarise the steps taken so far:

Summary of Steps Taken to Mitigate the Landing Zone Error

Initial Problem AWS Control Tower landing zone setup failed with error: "AWS Control Tower found that the account '094*** 868' is not in active status" The account '094 ***868' was identified as a Log Archive account that Control Tower attempted to create but left in an incomplete state

Step 1: Attempted Automated Decommissioning Action Taken:

Used AWS CLI to list existing landing zones: aws controltower list-landing-zones Initiated decommissioning with: aws controltower delete-landing-zone --landing-zone-id <identifier> Received operation identifier: 07633e49-2515-48be-bd23-1b80042347fb Result:

Decommissioning operation FAILED with the same error about account '094******868' not being in active status Confirmed that automated decommissioning cannot work with partially failed landing zone setups

Step 2: Investigated Account Status in AWS Organizations Action Taken:

Checked AWS Organizations console to examine the problematic account Attempted to remove account '094******868' from the organization Result:

Received ConstraintViolationException error Confirmed the account is missing prerequisites to operate as a standalone account (payment method, phone verification, contact information) Cannot remove the account through normal AWS Organizations processes

Step 3: Identified Root Cause Key Findings:

Account '094******868' is an incomplete Log Archive account created during the failed Control Tower setup AWS documentation states: "You can't use automated decommissioning to remove a landing zone that's partially set up" The account cannot be removed from the organization because it lacks required standalone account information This creates a circular dependency preventing both automated cleanup and manual account removal

Step 4: Escalated to AWS Support Action Taken:

Connected with AWS Support through the support assistant Provided comprehensive details including: Original error message and failed landing zone setup Failed decommission operation ID (07633e49-2515-48be-bd23-1b80042347fb) ConstraintViolationException details from Organizations Account status and missing prerequisites information Expected Resolution: AWS Support can perform manual backend operations to:

Force-remove the incomplete account from the organization Clean up stuck Control Tower resources Resolve account status issues Ensure complete cleanup for future setups Current Status Issue: Partially failed Control Tower setup with incomplete Log Archive account blocking all cleanup attempts Blocker: Circular dependency between Control Tower decommissioning and account removal requirements

Resolution Path: AWS Support intervention required for manual cleanup Next Steps: Await AWS Support assistance to resolve the backend resource conflicts This situation demonstrates a known limitation where partially failed Control Tower setups require AWS Support intervention rather than self-service cleanup options.