How do I resolve the "Your enrolled account was moved to another OU" error in AWS Control Tower?

Short description

If you use the Organizations console or the MoveAccount API to move an AWS account between OUs, then your account enters an inconsistent governance state.

You receive the following error message:

"Your enrolled account was moved to another OU. The account is in an inconsistent state and you may incur unintended charges. If the parent OU is unregistered, register the new OU or return the account to its original OU. If the parent OU is registered, re-register the OU or update the account in AWS Service Catalog. If problems persist, you can terminate the account in AWS Service Catalog and create a new account with AWS Control Tower account factory, or contact AWS Support."

To resolve, choose a resolution based on your OU and account scenario.

Resolution

Important: The following resolution applies to account drift only. Unless auto-enrollment is active, you must manually clean up drifted detective controls, such as AWS Config rule-based controls. For more information, see How do I resolve control drift in AWS Control Tower?

Resolve errors for an unregistered destination OU

AWS Control Tower doesn't manage the destination OU, so the moved account has no governance coverage. Choose one of the following options.

Keep the account in the destination OU

Register the destination OU to bring the account under AWS Control Tower governance. All accounts under the destination OU, including the moved account, are automatically enrolled.

Move the account back to its original OU

Make sure that you don't use the Organizations console to move the account back to the original OU. If you do, then you create additional drift on the original OU instead of clearing the existing drift.

To move the account back through AWS Control Tower and re-apply the original OU's baselines and controls, update the account in the AWS Control Tower console.

Resolve errors for a registered destination OU

AWS Control Tower manages the destination OU. The account is in the correct location, but you must re-sync the governance state.

Re-register the destination OU

Re-register the destination OU to apply the OU's baselines and controls to all accounts under it, including the moved account.

You can re-register an OU only when the OU has fewer than 1,000 accounts. If your OU exceeds this limit, then update each affected account individually through the AWS Control Tower console or AWS Service Catalog.

Note: The re-registration process can take 20 minutes to several hours depending on the number of accounts and active controls.

Update only the moved account

To update only the moved account, use either the AWS Control Tower console or Service Catalog console.

AWS Control Tower re-applies the destination OU's baselines and controls and removes configurations from the original OU.

Resolve a stuck or broken account state

If the moved account is stuck and can't be updated or re-enrolled through the console, then unmanage and then re-enroll the account. Choose either of the following resolutions based on whether your account is registered or unregistered.

Important: The following resolutions remove only the provisioned product in Service Catalog. The underlying AWS account isn't deleted, but the account temporarily loses AWS Control Tower governance coverage during the transition.

Registered destination OU

If the destination OU is registered, then complete the following steps:

1. Open the AWS Control Tower console.
2. In the navigation pane, choose Organization, and then select the account.
3. Choose Unmanage account.
4. After the process completes, re-enroll the account and place it in the destination OU.

Unregistered destination OU

Note: The following resolution doesn't apply if the account's destination OU is unregistered. For that scenario, use the TerminateProvisionedProduct.

If the destination OU is unregistered, complete the following steps:

1. Open the Service Catalog console in your management account.
2. In the navigation pane, choose Provisioned products.
3. Find the account's provisioned product, and then choose Terminate.
4. After the termination completes, re-enroll the account and place it in the destination OU.

Activate auto-enrollment to prevent future drift

Note: If you receive errors when you run AWS Command Line Interface (AWS CLI) commands, then see Troubleshooting errors for the AWS CLI. Also, make sure that you're using the most recent AWS CLI version.

If you activate auto-enrollment, then AWS Control Tower automatically applies the destination OU's baselines and controls when you move an account. AWS Control Tower also removes the original OU's configurations. Future account moves won't require manual cleanup. For more information, see Move and enroll accounts with auto-enrollment.

Use either the AWS Control Tower console or AWS CLI to activate auto-enrollment.

AWS Control Tower console

Complete the following steps:

1. Open the AWS Control Tower console.
2. In the navigation pane, choose Landing zone settings.
3. Choose Modify settings.
4. In the Automatic account enrollment section, choose Automatic account enrollment.
5. Choose Update landing zone.

AWS CLI

Complete the following steps:

1. To get your landing zone identifier, run the following list-landing-zones command:

   aws controltower list-landing-zones --region REGION

   Note: Replace REGION with your AWS Region.

2. To activate auto-enrollment, run the following update-landing-zone command:

   aws controltower update-landing-zone --landing-zone-identifier LANDING-ZONE-IDENTIFIER --landing-zone-version LANDING-ZONE-VERSION --remediation-types "INHERITANCE_DRIFT" --region REGION

   Note: Replace LANDING-ZONE-IDENTIFIER with your landing zone Amazon Resource Name (ARN), LANDING-ZONE-VERSION with your current landing zone version, and REGION with your Region.