How do I resolve the "No launch paths found for resource" error when I create an account in AWS Control Tower?

Short description

To create a new account or enroll an existing account, your AWS Identity and Access Management (IAM) identity must have access to the AWS Control Tower Account Factory portfolio in AWS Service Catalog.

If you try to create a new account without the correct permissions, then you receive the "No launch paths found for resource" error message. To resolve this error, grant portfolio access to the specific IAM identity that's trying to create the account. To confirm the identity that you're signed in as, select your username in the AWS Management Console.

You can also receive the error message if a user or operation deleted the AWS Control Tower Account Factory portfolio. To resolve, you must reset the landing zone to restore it. Then, Service Catalog has permission to provision your account in AWS Control Tower.

Resolution

Note: If you receive errors when you run AWS Command Line Interface (AWS CLI) commands, then see Troubleshooting errors for the AWS CLI. Also, make sure that you're using the most recent AWS CLI version.

Grant the IAM principal access to the Account Factory portfolio

Note: It's a best practice to associate the Account Factory portfolio with an IAM role rather than with individual IAM users. For example, you can associate the portfolio with the role that your AWS IAM Identity Center permission set uses.

To grant access to the portfolio, you can use the Service Catalog console or AWS CLI.

To use the console, complete the following steps:

1. Open the Service Catalog console.
2. In the navigation pane, choose Administration, and then choose Portfolios.
3. Choose AWS Control Tower Account Factory Portfolio, and then choose the Access tab.
4. Under Portfolio access, choose Grant access.
5. For Type, choose Principal Name, and then select the IAM user, group, or role that's trying to vend the account.
6. Choose Grant Access.

To use the AWS CLI, complete the following steps:

1. To retrieve the portfolio ID and save the ID to an environment variable, run the following list-portfolios AWS CLI command:

   PORTFOLIO_ID=$(aws servicecatalog list-portfolios --query "PortfolioDetails[?DisplayName=='AWS Control Tower Account Factory Portfolio'].Id" --output text)

2. To confirm that the variable is set, run the following command:

   echo $PORTFOLIO_ID

3. To associate the IAM principal with the portfolio, run the following associate-principal-with-portfolio AWS CLI command:

   aws servicecatalog associate-principal-with-portfolio --portfolio-id $PORTFOLIO_ID --principal-arn arn:aws:iam::111122223333:role/ExampleRole --principal-type IAM

   Note: Replace arn:aws:iam::111122223333:role/ExampleRole with the Amazon Resource Name (ARN) of the IAM user, group, or role that's trying to vend the account.

4. To verify the association, run the following list-principals-for-portfolio AWS CLI command:

   aws servicecatalog list-principals-for-portfolio --portfolio-id $PORTFOLIO_ID

Then, attach the correct permissions to your IAM identity to access the Service Catalog console. For more information, see Identity-based policy examples for AWS Service Catalog.

Restore a deleted portfolio

If your IAM identity has access and you still receive the error, then a user or operation might have deleted the AWS Control Tower Account Factory portfolio from Service Catalog. Then, AWS Control Tower can't manually recreate the portfolio because no launch path exists. You must reset the landing zone to restore the portfolio and its launch paths.

Confirm the portfolio was deleted

To use the Service Catalog console, complete the following steps:

1. Open the Service Catalog console.
2. In the navigation pane, choose Administration, and then choose Portfolios.
3. Look for AWS Control Tower Account Factory Portfolio. If it isn't listed, then the portfolio was deleted.

To use the AWS CLI, run the following list-portfolios AWS CLI command:

aws servicecatalog list-portfolios --query "PortfolioDetails[?DisplayName=='AWS Control Tower Account Factory Portfolio']"

If the response returns an empty list, then the portfolio was deleted.

Reset the landing zone

Important: Reset the landing zone only if you have landing zone version 3.1 or later. To update your landing zone, see Resolve drift with Reset and Re-register.

A reset redeploys the AWS Control Tower configuration based on your saved manifest and is non-disruptive to your accounts and resources.

To use the AWS Control Tower console, complete the following steps:

1. Open the AWS Control Tower console.
2. In the navigation pane, choose Landing zone settings.
3. Choose Reset.

To use the AWS CLI, complete the following steps:

1. To retrieve the landing zone ARN, run the following list-landing-zones AWS CLI command:

   aws controltower list-landing-zones

   Note: The list-landing-zones command works for all AWS Regions.
2. To reset the landing zone in its home Region, run the following reset-landing-zone AWS CLI command:

   aws controltower reset-landing-zone --landing-zone-identifier arn:aws:controltower:us-east-1:444455556666:landingzone/EXAMPLE1234XXXX --region HOME-REGION

   Note: Replace arn:aws:controltower:us-east-1:444455556666:landingzone/EXAMPLE1234XXXX with the landing zone ARN from step 1 and replace HOME-REGION with the Region embedded in that ARN. You must run reset-landing-zone in the home Region. If you run it in a different Region, then the command fails with a ResourceNotFoundException error. The command returns an operationIdentifier that you can use to track the reset.

Related information

Granting access to users

Provision and manage accounts with Account Factory

How AWS Control Tower works