Enroll an existing account

• Navigate to the Organization page in AWS Control Tower.

• Find the name of the account you wish to enroll. To find it, choose Accounts only from the dropdown menu at the upper right, and then locate the account name in the filtered table.

• Follow the steps for enrolling an individual account, as shown in the Steps to enroll an account section.

To enroll an individual account in AWS Control Tower

• Navigate to the AWS Control Tower Organization page.

• On the Organization page, accounts that are eligible to be enrolled allow you to select Enroll from the Actions dropdown menu at the top of the section. These accounts also show an Enroll account button when you view them on the Account details page.

• When you choose Enroll account, you’ll see an Enroll account page, where you are prompted to add the AWSControlTowerExecution role to the account. For some instructions, see Manually add the required IAM role to an existing AWS account and enroll it.

• Next, select a registered OU from the drop down list. If the account is already in a registered OU, this list will show the OU.

• Choose Enroll account.

• You’ll see a modal reminder to add the AWSControlTowerExecution role and confirm the action.

• Choose Enroll.

• AWS Control Tower begins the process of enrollment, and you are directed back to the Account details page.

• To enroll an existing account, the AWSControlTowerExecution role must be present in the account you're enrolling.

• Your IAM principal may lack the necessary permissions to provision an account.

• AWS Security Token Service (AWS STS) is disabled in your AWS account in your home Region, or in any Region supported by AWS Control Tower.

• You may be signed in to an account that needs to be added to the Account Factory Portfolio in AWS Service Catalog. The account must be added before you'll have access to Account Factory so you can create or enroll an account in AWS Control Tower. If the appropriate user or role is not added to the Account Factory portfolio, you’ll receive an error when you attempt to add an account. For instructions on how to grant access to AWS Service Catalog portfolios, see Granting access to users.

• You may be signed in as root.

• The account you're trying to enroll may have AWS Config settings that are residual. In particular, the account may have a configuration recorder or delivery channel. These must be deleted or modified through the AWS CLI before you can enroll an account. For more information, see Enroll accounts that have existing AWS Config resources and Interact with AWS Control Tower through AWS CloudShell.

• If the account belongs to another OU with a management account, including another AWS Control Tower OU, you must terminate the account in its current OU before it can join another OU. Existing resources must be removed in the original OU. Otherwise, enrollment will fail.

• Account provisioning and enrollment fails if your destination OU’s SCPs don’t allow you to create all of the resources required for that account. For example, an SCP in your destination OU may block resource creation without certain tags. In this case, account provisioning or enrollment fails, because AWS Control Tower does not support tagging of resources. For help, contact your account representative, or AWS Support.

Recommended: You can set up a two-step approach to account enrollment

• First, use an AWS Config conformance pack to evaluate how your accounts may be affected by some AWS Control Tower controls. To determine how enrollment into AWS Control Tower may affect your accounts, see Extend AWS Control Tower governance using AWS Config conformance packs.

• Next, you may wish to enroll the account. If the compliance results are satisfactory, the migration path is easier because you can enroll the account without unexpected consequences.

• After you've done your evaluation, if you decide to set up an AWS Control Tower landing zone, you may need to remove the AWS Config delivery channel and configuration recorder that were created for your evaluation. Then you'll be able to set up AWS Control Tower successfully.