Control Tower Update Failure - Delete delivery Channels - Still fails

0

Hello,

We are trying to add a region to our landing zone settings. We wanted to add California as one of our governed zones.

We modified the landing zone set leaving everything the same except adding California under region configuration. We hit update and got an error.

We got the error "AWS Control Tower failed to completely set up your landing zone: AWS Control Tower cannot create an AWS Config delivery channel because one already exists. To continue, delete the existing delivery channel and try again."

We proceeded by stopping the configuration recorder and deleting all delivery channel and configuration records using CLI in all accounts in all regions.

aws configservice stop-configuration-recorder --configuration-recorder-name [RECORD NAME]
aws configservice delete-delivery-channel --delivery-channel-name [DELIVER CHANNEL NAME]
aws configservice delete-configuration-recorder --configuration-recorder-name [RECORD NAME]

I retried updating the landing zone, which failed again with the same error message.

We set up our Control tower is 03/2023. We have enabled other dependent resources like Security Hub, Macie, Guard duty, and other resource-dependent solutions. If we cannot add the California region, how can we revert to our original landing zone setting?

Any advice?

Thanks,

dmutuku
已提問 1 年前檢視次數 644 次
1 個回答
1

Hello dmutuku, I think that you might need to check the configurations in California region and make sure to delete aggregator authorization as well. This error generally appears when you enroll a new account to your CT, which has an existing Config recorder. To fix this issue, you need to 1/ delete an existing delivery channel, 2/ delete an existing configuration recorder, 3/ lastly, delete Authorizations in AWS Config console > Aggregators > Authorizations. This documentation would be helpful for you to understand details. https://docs.aws.amazon.com/config/latest/developerguide/authorize-aggregator-account-console.html I hope it works. :)

profile pictureAWS
已回答 9 個月前

您尚未登入。 登入 去張貼答案。

一個好的回答可以清楚地回答問題並提供建設性的意見回饋,同時有助於提問者的專業成長。

回答問題指南