AWS Control Tower failed to set up your landing zone completely

When you deprivation your landing zone in Control Tower the AWSControlTowerExecution role is removed. However, the organization and the accounts remain. Therefore, in order to set up a new landing zone with Control Tower you must follow these steps.

Preparatory steps to bring an account into the same organization as AWS Control Tower

1. Drop the account from its existing organization. You must provide a separate payment method if you use this approach
2. Invite the account to join the AWS Control Tower organization. For more information, see Inviting an AWS account to join your organization in the AWS Organizations User Guide.
3. Accept the invitation. The account shows up in the root of the organization. This step moves the account into the same organization as AWS Control Tower. and establishes SCPs and consolidated billing.

OR

Steps to fulfill the remaining prerequisites:

1. Create the necessary AWSControlTowerExecution role.
2. Clear out the default VPC. (This part is optional. AWS Control Tower doesn't change your existing default VPC.)
3. Delete or modify any existing AWS Config configuration recorder or delivery channel through the AWS CLI or AWS CloudShell. For more information, see Example AWS Config CLI commands for resource status and Enroll accounts that have existing AWS Config resources

The following YAML template may assist you in creating the required role in an account, so that it can be enrolled programmatically.

AWSTemplateFormatVersion: 2010-09-09
Description: Configure the AWSControlTowerExecution role to enable use of your
  account as a target account in AWS CloudFormation StackSets.
Parameters:
  AdministratorAccountId:
    Type: String
    Description: AWS Account Id of the administrator account (the account in which
      StackSets will be created).
    MaxLength: 12
    MinLength: 12
Resources:
  ExecutionRole:
    Type: AWS::IAM::Role
    Properties:
      RoleName: AWSControlTowerExecution
      AssumeRolePolicyDocument:
        Version: 2012-10-17
        Statement:
          - Effect: Allow
            Principal:
              AWS:
                - AdministratorAccountId
            Action:
              - sts:AssumeRole
      Path: /
      ManagedPolicyArns:
        - arn:${AWS::Partition}:iam::aws:policy/AdministratorAccess

https://docs.aws.amazon.com/controltower/latest/userguide/enroll-account.html

Hi There

Please double check you have addressed all of the items in Setup after decommissioning a landing zone before retrying.

Are you bringing your own log archive and Audit accounts or is Control Tower creating new ones?