Control Tower landing zone stuck after closing accounts - delete-landing-zone fails with "account not in active status".

You're not actually blocked by your support plan here, and the accounts are very likely recoverable if they were closed recently. Here's the order of operations.

1. The decommission is failing for the reason it says: the shared accounts have to be active. Control Tower's automated decommission has to assume a role in the Log Archive and Audit accounts, and a closed/suspended account has no assumable roles, so the process cannot complete. Reopening those accounts is the prerequisite, not an optional step. See the decommission and known-issues docs:

• Decommission a landing zone: https://docs.aws.amazon.com/controltower/latest/userguide/decommission-landing-zone.html
• Setup/known issues after decommissioning: https://docs.aws.amazon.com/controltower/latest/userguide/known-issues-decommissioning.html

2. A closed AWS account can be reopened, but only within the post-closure window. After you close an account it enters a 90-day period during which AWS Support can reopen it on request; once that window passes the closure is permanent and it cannot be reopened. So time matters here - act now if the closure was recent.

• Close/reopen behavior: https://docs.aws.amazon.com/awsaccountbilling/latest/aboutv2/close-account.html
• CloseAccount API (post-closure reopen window): https://docs.aws.amazon.com/organizations/latest/APIReference/API_CloseAccount.html
• Reopen an AWS account: https://repost.aws/knowledge-center/reopen-aws-account

3. You do not need a paid support plan to get this done. Account and billing support, which includes reopening/reactivating an account, is available to every account owner at no cost. Only personalized technical troubleshooting requires a paid plan, and reopening a closed account is an account matter, so open the case under Account and Billing rather than Technical.

• Free account and billing support: https://docs.aws.amazon.com/awsaccountbilling/latest/aboutv2/billing-get-answers.html

4. The disabled root recovery is expected, not a bug. Control Tower-vended member accounts are created without standalone root credentials (this is the centralized/managed root behavior), which is why "forgot password" does nothing for them. Reactivation therefore has to go through AWS Support rather than a self-service reset.

• Member accounts and root credentials: https://docs.aws.amazon.com/signin/latest/userguide/troubleshooting-sign-in-issues.html
• When to sign in as root (Control Tower): https://docs.aws.amazon.com/controltower/latest/userguide/root-login.html

Suggested steps:

1. Open an Account and Billing support case (free) from the management account and ask AWS to reopen the two closed member accounts, referencing that they are Control Tower shared accounts (Log Archive / Audit) and that you need them active to decommission the landing zone.
2. Once they're active again, run the decommission from the Landing Zone Settings > Decommission tab (or re-run delete-landing-zone).
3. If any resources were left behind after a failed decommission, clean them up manually: the AWSControlTowerBP-* CloudFormation stacks, aws-controltower-logs-* S3 buckets, and aws-controltower/CloudTrailLogs log groups.
4. On the region lock: your Organizations home region is fixed once set and can't be switched, so a fresh landing zone will need to be built in that same home region.

If the accounts were closed more than 90 days ago they can't be reopened, in which case a support case to the account and billing (available to Basic Support customers) is still the right move so AWS can help clean up the orphaned Control Tower metadata directly.

Hello, if you're planning to decommission the landing zone, please re-open the accounts. The reason you're seeing the error is because the accounts are not active. The log archive and audit accounts need to be active for the automated decommissioning workflow to succeed. You do not need a paid support plan for account re-instatement.

You also do not need root user credentials to re-open the accounts (this is only necessary if you're reopening a standalone account). To reopen a closed member accounts linked to an organization, you'd have to create a support case from the organization management/payer account (this the same account where you deployed Control Tower landing zone). Once the accounts are re-opened, please retry decommissioning landing zone. If you still encounter unable to assume the AWSControlTowerExecution role error, you may have to log into both log archive and audit account to create the role manually. If you encounter any issues, let me know.

Thank you!