AWS Control Tower failed to set up your landing zone completely

Question

I decommissioned the landing zone a while back and I am trying to create a new one. I followed the manual cleanup steps as outlined [here](https://docs.aws.amazon.com/en_us/controltower/latest/userguide//known-issues-decommissioning.html).

The issue I am having is that I am getting:
"AWS Control Tower failed to deploy one or more stack set instances b/c AWSControlTowerExecution role is not authorized to perform: logs:DeleteLogGroup on resource: arn:aws:logs:us-east-1:XXXXXXXXXX:log-group:/aws/lambda/aws-controltower-NotificationForwarder:log-stream: with an explicit deny in a service control policy" and I currently have no SCPs in place other than FullAWSAccess.

When I check the CloudFormation, I see similar complaints about SCPs preventing deletion of certain log groups.
I appreciate any insight regarding the issue.

Answer

Try the following:

Add the logs:DeleteLogGroup permission for arn:aws:logs:${region}

Answer

Did you check the correct organizational unit(OUs) or member account? If you go to your management account - AWS Organizations - Policies - Service control policies. What can you see?

AWS Control Tower failed to set up your landing zone completely

Relevant content