How do I resolve AWS Config delivery channel or configuration recorder resource errors in AWS Control Tower?

Short description

Before AWS Control Tower sets up the resources in your landing zone or enrolls the account, it runs automated pre-launch checks to confirm that the environment meets all prerequisites. If either of the resources already exists in an AWS Region that you want to govern with AWS Control Tower, then the validation fails.

When validation fails, you receive one of the following error messages:

• "AWS Control Tower cannot create an AWS Config delivery channel because one already exists. To continue, delete the existing delivery channel and try again."
• "AWS Control Tower cannot create an AWS Config configuration recorder because one already exists. To continue, delete the existing configuration recorder and try again."

To resolve the issue, find the existing AWS Config resources in governed Regions from your enrolling member account, and then choose one of the following options:

• If you don't require the existing AWS Config configuration recorder or delivery channel, then delete the resources.
  Important: Before you delete a resource, confirm that you no longer require it. When you delete an AWS Config delivery channel or configuration recorder, AWS Config no longer records resource configuration changes in the Region that they're in. You lose the associated configuration history.
• To keep your existing AWS Config resources and enroll the account, update the resources to align with AWS Control Tower.

Resolution

Note: If you receive errors when you run AWS Command Line Interface (AWS CLI) commands, then see Troubleshooting errors for the AWS CLI. Also, make sure that you're using the most recent AWS CLI version.

Find existing AWS Config resources in all Regions

Note: The following commands use describe-regions to describe all the Regions in your account that you opted into. If a Region is unreachable, then the command skips it and continues to the next Region.

To list the configuration recorders in all Regions, run the following command:

echo "" && echo "Looking for configuration recorders (no output = no recorder)"
for region in $(aws ec2 describe-regions --all-regions --query 'Regions[?OptInStatus!=`not-opted-in`].RegionName' --output text); do
  echo "Target: $region"
  result=$(aws configservice describe-configuration-recorders --region $region --cli-connect-timeout 5 --cli-read-timeout 10 --query 'ConfigurationRecorders[*].name' --output text 2>/dev/null) || { echo "   Skipped $region (unreachable)"; continue; }
  [[ $result != "" ]] && echo "   Configuration recorder \"$result\" exists in $region"
done

To list the delivery channels in all Regions, run the following command:

echo "" && echo "Looking for delivery channels (no output = no channel)"
for region in $(aws ec2 describe-regions --all-regions --query 'Regions[?OptInStatus!=`not-opted-in`].RegionName' --output text); do
  echo "Target: $region"
  result=$(aws configservice describe-delivery-channels --region $region --cli-connect-timeout 5 --cli-read-timeout 10 --query 'DeliveryChannels[*].name' --output text 2>/dev/null) || { echo "   Skipped $region (unreachable)"; continue; }
  [[ $result != "" ]] && echo "   Delivery channel \"$result\" exists in $region"
done

If the output lists delivery channels or configuration recorders, then note the resource names and Regions. Then, you can either delete a specific resource in a specific Region, or delete all resources in every Region.

Note: Turning off AWS Config on the console doesn't delete AWS Config resources. To delete the resources, you must use the AWS CLI.

Delete a specific AWS Config resource in a specific Region

Important: Before you delete the delivery channel, you must stop the configuration recorder because the recorder contains the delivery channel.

Complete the following steps:

1. To stop the configuration recorder, run the following stop-configuration-recorder AWS CLI command:

   aws configservice stop-configuration-recorder --configuration-recorder-name RECORDER_NAME --region REGION

   Note: Replace RECORDER_NAME with the recorder name and REGION with the Region that your AWS Config resources are in.
2. To delete the delivery channel, run the following delete-delivery-channel AWS CLI command:

   aws configservice delete-delivery-channel --delivery-channel-name CHANNEL_NAME --region REGION

   Note: Replace CHANNEL_NAME with the delivery channel name and REGION with the Region.
3. To delete the configuration recorder, run the following delete-configuration-recorder AWS CLI command:

   aws configservice delete-configuration-recorder --configuration-recorder-name RECORDER_NAME --region REGION

   Note: Replace RECORDER_NAME with the recorder name and REGION with the Region.

In landing zone versions that are earlier than 4.0, your account might also have AWS Config aggregation authorizations. Aggregation authorizations don't cause this error, but you can delete them.

To list the aggregation authorizations, run the following describe-aggregation-authorizations AWS CLI command:

aws configservice describe-aggregation-authorizations --region REGION

Note: Replace REGION with your Region.

To delete an aggregation authorization, run the following delete-aggregation-authorization AWS CLI command:

aws configservice delete-aggregation-authorization --authorized-account-id AGGREGATOR_ACCOUNT_ID --authorized-aws-region AGGREGATOR_REGION --region SOURCE_REGION

Note: Replace AGGREGATOR_ACCOUNT_ID with the aggregator account ID, AGGREGATOR_REGION with the aggregator Region, and SOURCE_REGION with the Region where you found the aggregation authorization.

Delete all AWS Config recorders and delivery channels in every Region

Important: The following command deletes all AWS Config configuration recorders and delivery channels in every Region, including Regions that AWS Control Tower doesn't govern. Run it only when you're certain that no other workloads depend on AWS Config in these Regions.

Run the following command:

for REGION in $(aws ec2 describe-regions --query 'Regions[].RegionName' --output text); do
  echo -e "\nRegion: $REGION"
  RECORDER=$(aws configservice describe-configuration-recorders --region $REGION --cli-connect-timeout 5 --cli-read-timeout 10 --query 'ConfigurationRecorders[].name' --output text 2>/dev/null) || { echo "Skipped $REGION (unreachable)"; continue; }
  CHANNEL=$(aws configservice describe-delivery-channels --region $REGION --cli-connect-timeout 5 --cli-read-timeout 10 --query 'DeliveryChannels[].name' --output text 2>/dev/null)
  if [[ $RECORDER != "" ]]; then
    echo "Stopping configuration recorder $RECORDER"
    aws configservice stop-configuration-recorder --configuration-recorder-name $RECORDER --region $REGION
  fi
  if [[ $CHANNEL != "" ]]; then
    echo "Deleting delivery channel $CHANNEL"
    aws configservice delete-delivery-channel --delivery-channel-name $CHANNEL --region $REGION
  fi
  if [[ $RECORDER != "" ]]; then
    echo "Deleting configuration recorder $RECORDER"
    aws configservice delete-configuration-recorder --configuration-recorder-name $RECORDER --region $REGION
  fi
done

Resolve an explicit deny error

A delete command might fail with an "AccessDeniedException" error because of an explicit deny in a service control policy (SCP). To resolve this issue, assume the AWSControlTowerExecution role in the target account before you run the command again.

Complete the following steps:

1. Open the AWS Control Tower console in your management account.
2. In the navigation pane, select your account, and then choose Switch role.
   Note: If you opted in to multi-session support, then choose Add session, and then choose Switch role.
3. Enter the target account ID and the AWSControlTowerExecution role name, and then choose Switch Role.
4. Run the delete command again.

Related information

Failure error that mentions AWS Config

Working with the configuration recorder

Working with the delivery channel

To switch to a role