Control Tower setup - Insufficient privileges to create a backup vault. Creating a backup vault requires backup-storage and KMS permissions.

I think the error occurs because the AWSControlTowerExecution role in the target account (e.g., Audit or Log Archive) lacks the necessary permissions to create the Backup Vault and interact with KMS. Since this is a StackSet deployment, it is restricted by Service Control Policies (SCPs) or Permissions Boundaries, regardless of your personal Administrator status.

I would check the following:

1. Check Service Control Policies (SCPs):

In the Management Account, go to AWS Organizations > Policies. Ensure no SCP is explicitly denying backup:* or kms:* actions. Look specifically for "Deny-All-Except-Listed-Regions" policies that might be blocking the region eu-central-1.

2. Verify KMS Key Policy:

If you enabled encryption for Control Tower, the KMS Key Policy must allow the cloudformation.amazonaws.com service principal and the AWSControlTowerExecution role to perform kms:CreateGrant and kms:GenerateDataKey.

3. Permissions Boundaries:

Check if the AWSControlTowerExecution role in the target account has a Permissions Boundary attached that excludes the AWS Backup service.

After „relaxing“ the SCP or updating the Key Policy, go to the Control Tower Dashboard and select Landing Zone Settings > Repair to re-run the deployment.

Checking my own settings again, I think you will need to enable Backup from Landing Zone settings. I have added a screen shot below.

Check for your AWSControlTowerExecution role and confirm it has backup:* and kms:* permissions in the eu-central-1 account. If not, it has be to added to Control Tower's role. Note, backup:* and kms:* are too broad, so, you might create granular permissions as needed.

Hello.

The "AWSControlTowerExecution" role is automatically created for AWS accounts created in Account Factory, but you need to create it yourself if you add an existing account to Control Tower.
Please try adding it using the following documentation as a reference.
https://docs.aws.amazon.com/controltower/latest/userguide/awscontroltowerexecution.html

For accounts in the Security OU (sometimes called core accounts), AWS Control Tower creates the role at the time of initial AWS Control Tower setup.
For an Account Factory account created through the AWS Control Tower console, AWS Control Tower creates this role at the time of account creation.
For a single account enrollment, we ask customers to manually create the role and then enroll the account in AWS Control Tower.
When extending governance to an OU, AWS Control Tower uses the StackSet-AWSControlTowerExecutionRole to create the role in all accounts in that OU.

You need to create an IAM role for each AWS account managed by Control Tower.
The Control Tower management account will then use that IAM role to perform operations.
https://docs.aws.amazon.com/controltower/latest/userguide/conditions-for-role-trust.html

{
  "Version":"2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Principal": {
        "Service": [
          "controltower.amazonaws.com"
        ]
      },
      "Action": "sts:AssumeRole",
      "Condition": {
        "ArnEquals": {
          "aws:SourceArn": "arn:aws:controltower:us-west-2:012345678901:*"
        }
      }
    }
  ]
}

Could you please verify the KMS key policy for the multi-region KMS key you are using for backup? Also, if you are governing multiple regions, please ensure that the key is replicated across all the regions BEFORE you enable backup. Additionally, if you make any changes to the KMS key policy of a multi-region key after you created a replica, the key policy is NOT automatically propagated to the replica keys, and you'd have to manually modify the key policy to match what's shown in the documentation