I've messed up my AWS Control Tower instance while experimenting with it. I skipped the correct teardown procedure and deleted the Foundation Organizational Units (OUs) along with two accounts. Now, when I try to reset it, I get an error saying the two foundation accounts aren't active. I tried moving the accounts back into their OUs, but that didn't help either. Since this is a personal account and I don't have business support, what are my options to recover from this? Should I reach out to AWS to reactivate those accounts, or is there something else I can do? Here's the error message I got, and yes, I'm logged in as the management account root: [Error Image Link](https://imgur.com/eAF0NHV).
2 Answers
You really need to reopen those accounts that are currently closed or suspended and then try the reset again. Just a heads up, Control Tower can be pretty finicky, especially when you start customizing IAM resources. Many companies back away from it as they mature since it's so rigid. Just something to think about!
I used Control Tower for a while at a large organization with many accounts, but it became super sensitive to changes. We eventually stopped using it because it was much easier to manage everything without those constraints.
I've been in a similar boat! The AWS Control Tower teardown process can be tricky. I recommend checking section 4.3 in the official documentation—they might need to rebuild your landing zone for you.
Could you share the link? I looked through the decommissioning guide but couldn't find a way out of this mess.
I totally get that. Our AWS account manager convinced us to give it a shot, and now I regret the decision.