Skip to content
By using AWS re:Post, you agree to the AWS re:Post Terms of Use
AWS re:Postre:Post
About re:Post

AWS App Studio onboarding fails with EntityAlreadyExistsException after successful IAM Identity Center enablement

0

Region: App Studio us-west-2, IAM Identity Center us-east-1 Note: Understanding App Studio is only available in Oregon I did switch Region to Oregon and the setup accepted my IAM group etc.

Logged in as: Root user

Symptoms: Initial App Studio onboarding started successfully. CloudTrail shows StartEnablementJob succeeded. CloudTrail later shows sso.amazonaws.com CreateInstance invoked by appstudio-service.amazonaws.com failed with:

  • ThrottlingException
  • Rate exceeded App Studio IAM roles were created: AWSServiceRoleForAppStudio
  • AppStudioAccessRole
  • AppStudioManagedStorageCDKDeployRole
  • AppStudioManagedStorageDDBAccess IAM Identity Center is operational and App Studio can enumerate my Admins group. Every subsequent setup attempt fails with:
  • EntityAlreadyExistsException

It appears the initial provisioning partially completed and the App Studio onboarding state is now stuck.

I believe I need to get the onboarding state reset or repaired for this account. But would appreciate any help.

Thank you.

Topics
Machine Learning & AISecurity, Identity, & ComplianceGenerative AI on AWS
Tags
AWS IAM Identity CenterAWS App Studio
Language
English

asked a month ago45 views

2 Answers
0

The official AWS App Studio troubleshooting documentation "Troubleshooting App Studio setup, permissions, and onboarding - AWS App Studio" states the following:

Setting up App Studio with the Create an account instance for me will fail if you have an account-level IAM Identity Center instance in any AWS Region, as IAM Identity Center only supports one instance.

This is precisely the situation you are facing. IAM Identity Center is already successfully enabled and running in us-east-1. However, the App Studio onboarding process (in us-west-2/Oregon)—failing to correctly detect the existing instance (or perhaps due to a race condition where detection hadn't completed)—attempts to call sso.amazonaws.com CreateInstance on its own. This triggers an EntityAlreadyExistsException because it violates the constraint that only one IAM Identity Center instance can be created per account across all regions. In short, this is not a configuration error; it is a known failure pattern where the App Studio onboarding flow fails to correctly handle an existing cross-region IAM Identity Center instance.

  • Recommended Solution (based on official documentation):

Navigate to the IAM Identity Center console at https://console.aws.amazon.com/singlesignon/ to check if you have an IAM Identity Center instance. Check every supported AWS Region until you locate the instance. You can either use that instance when setting up App Studio, or delete the IAM Identity Center instance and try again with the Create an account instance for me option.

answered a month ago

  • markwybe
    a month ago

    Thanks Taka - much appreciated. But I believe my case differs slightly from the documented scenario because there was initially no IAM Identity Center instance. CloudTrail shows App Studio successfully starting StartEnablementJob, then invoking sso.amazonaws.com CreateInstance, which failed with ThrottlingException: Rate exceeded. Identity Center was nevertheless created successfully and is now detected by App Studio, but retries fail with EntityAlreadyExistsException. App Studio also created its service-linked IAM roles. This appears to be a partially completed onboarding rather than an attempt to create a second Identity Center instance. Definitely open to more ideas for sure - thanks.

0

Based on the symptoms you're describing, it appears your App Studio setup encountered a partial completion state. When setting up App Studio with the "Create an account instance for me" option, the process will fail if you already have an account-level IAM Identity Center instance in any AWS Region, as IAM Identity Center only supports one instance per account.

Since you mentioned that IAM Identity Center is in us-east-1 and you're setting up App Studio in us-west-2 (Oregon), this could be the root cause. The setup process likely attempted to create a new IAM Identity Center instance but encountered the existing one, leading to the EntityAlreadyExistsException you're seeing on subsequent attempts.

To resolve this issue:

  1. Navigate to the IAM Identity Center console at https://console.aws.amazon.com/singlesignon/ and verify your existing instance location (us-east-1 in your case).

  2. When setting up App Studio, you should select the option to use your existing IAM Identity Center instance rather than having App Studio create a new one.

  3. If you've already attempted setup multiple times and the state appears stuck, you may need to clean up the partially created resources before trying again.

Since this involves a partially completed setup with service roles already created and a stuck onboarding state, I recommend reaching out through the AWS Support Center at https://console.aws.amazon.com/support/ to add correspondence about this specific situation. The support team can help verify the account state and assist with any necessary cleanup or state reset to allow you to complete the onboarding process successfully with your existing IAM Identity Center instance.
Sources
Troubleshooting App Studio setup, permissions, and onboarding - AWS App Studio
AWS App Studio and AWS Identity and Access Management (IAM) - AWS App Studio

answered a month ago

You are not logged in. Log in to post an answer.

A good answer clearly answers the question and provides constructive feedback and encourages professional growth in the question asker.

Relevant content