enroll_account.py - mistyped target registered OU

0

So I was testing out the enroll_account.py script outlined here https://aws.amazon.com/blogs/field-notes/enroll-existing-aws-accounts-into-aws-control-tower/, in order to enroll an existing unregistered account (that was already in the organization) into control tower. This was a single account, currently sitting in an unregistered OU. Unfortunately, I got the capitalization wrong on one of the letters for the target registered OU where the new account was to be put and it errored (I put WorkLoads instead of Workloads), and now the account enrollment errors out. See below:

[ec2-user@ip-10-0-101-238 ~]$ python3 enroll_account.py -o WorkLoads -i <account number redacted>

Executing on AWS Account: <redacted>, assumed-role/AWSReservedSSO_AWSAdministratorAccess_bf1c0c3371d5ee07/<redacted>@<redacted>.edu
PRECHECK SUCCEEDED. Proceeding
Launching Enroll-Account-BusinessDivision01
Status: UNDER_CHANGE. Waiting for 6.0 min to recheck
ERROR: 165929507703
[ec2-user@ip-10-0-101-238 ~]$ python3 enroll_account.py -o Workloads -i <account number redacted>

Executing on AWS Account: <redacted>, assumed-role/AWSReservedSSO_AWSAdministratorAccess_bf1c0c3371d5ee07/<redacted>@<redacted>.edu
PRECHECK SUCCEEDED. Proceeding
Launching Enroll-Account-BusinessDivision01
SC product provisioning failed: An error occurred (InvalidParametersException) when calling the ProvisionProduct operation: A stack named Enroll-Account-BusinessDivision01 already exists.
ERROR: 165929507703
[ec2-user@ip-10-0-101-238 ~]$

Anyone have a hint as to where to go from here or theories on how I could get myself out of this? This was just a test account in my dev environment so if need be, blowing away the target account is fine, however, i'd like to use this as a learning experience in case it ever goes this way with a production account in the future.

Edited by: jgilfoil on Oct 31, 2020 3:51 PM

已提問 4 年前檢視次數 255 次
3 個答案
0

One further piece of information, I can't find the stack named Enroll-Account-BusinessDivision01 in either the master account or the target account.

已回答 4 年前
0

Ok, i realized that it's not talking about the stack, it's talking about the provisioned product in the service catalog. I guess i'll try terminating that and see if it lets me continue.

已回答 4 年前
0

Yup, that worked. I terminated the provisioned product in AWS Service Catalog and then re-ran the script with the properly spelled OU and it succeeded.

已回答 4 年前

您尚未登入。 登入 去張貼答案。

一個好的回答可以清楚地回答問題並提供建設性的意見回饋,同時有助於提問者的專業成長。

回答問題指南