How do I resolve the "AWS Control Tower cannot create an account because you have reached the limit" error message?

Resolution

To deploy a landing zone or create a new account with AWS Control Tower Account Factory, your organization must be within the Maximum number of accounts quota. If you exceed the quota and try to create a new account or set up a landing zone, then you receive the following error message:

"AWS Control Tower cannot create an account because you have reached the limit on the number of accounts in your organization."

To resolve this error, you must request a quota increase from AWS.

Note: If you receive errors when you run AWS Command Line Interface (AWS CLI) commands, then see Troubleshooting errors for the AWS CLI. Also, make sure that you're using the most recent AWS CLI version.

Get a count of your current accounts

The AWS Organizations console doesn't show the total number of accounts that are in your organization.

To see the total number of accounts, run the following list-accounts AWS CLI command from your management account:

aws organizations list-accounts --query "Accounts[?State!='PENDING_ACTIVATION']" --region us-east-1

You must have the output to choose a new quota in the next section of this article.

Note: You can view and request changes to Organizations service quotas only from the US East (N. Virginia) AWS Region. The Maximum number of accounts quota counts every account in the organization that finished the sign-up process, regardless of state. The count includes ACTIVE, SUSPENDED, PENDING_CLOSURE, and CLOSED accounts that are still in the 90-day post-closure period.

Review quota behaviors and requirements

Before you request a quota increase or close accounts in your organization, review the following quota behaviors and requirements:

• Closed accounts remain in the organization during the 90-day post-closure period and still count toward your quota. To free up quota space immediately, remove the member account from your organization before you close it.
• The AWS default quota value is 10 accounts per organization.
• The Service Quotas console displays the Applied account-level quota value as Not available. If you see this message, then contact AWS Support to request your applied value.

For more information, see Quotas and service limits for AWS Organizations and Limitations and quotas in AWS Control Tower.

Request a quota increase

You can only submit a quota increase request from an organization's management account. You can use the Service Quotas console or the AWS CLI.

To use the Service Quotas console to request an increase, complete the following steps:

1. Sign in to your AWS Control Tower management account, and then choose the US East (N. Virginia) Region.
2. Open the Service Quotas console.
3. In the navigation pane, choose AWS services, and then choose AWS Organizations.
4. Choose Maximum number of accounts, and then choose Request increase at account level.
5. For Increase quota value, enter a value greater than the value you received from the list-accounts command output.
6. Choose Request.

To use the AWS CLI to request an increase, run the following request-service-quota-increase command from your management account:

aws service-quotas request-service-quota-increase --service-code organizations --quota-code L-E619E033 --desired-value NEW_VALUE --region us-east-1

Note: Replace NEW_VALUE with a new account quota value that's greater than the value you received from the list-accounts command output from the earlier section. The quota code L-E619E033 is the Maximum number of accounts quota for Organizations.

After AWS approves your request, you can create a new account or set up a landing zone again.