The baseline 'AWSControlTowerBaseline' cannot be enabled on the Security OU* about landing-zone-accelerator-on-aws HOT 8 OPEN

We hit the same bug during the upgrade from v1.6.4 to v1.8.0/v1.8.1

from landing-zone-accelerator-on-aws.

Thank you for your prompt response. Could you please advise on how I can resolve this error and what steps I should take next? Additionally, I would like to update the baseline already set on the child’s accounts Audit and Log Archive to the latest version 4, and LZA try to apply it to the Security OU and this step is failing. Thanks

from landing-zone-accelerator-on-aws.

Hello @cloudgury, thank you for filing an issue with the Landing Zone Accelerator team!

To ensure we have all relevant details for this issue, could you please confirm if the Organizational Unit (OU) registered with ControlTower has ever been manually renamed?

Thanks, and we look forward to hearing back from you!

from landing-zone-accelerator-on-aws.

Yes, the OU was renamed because it originally only had an AWS Organization installed in the accounts, which already had a Security OU and a security account. Before installing Control Tower, I had to rename the old OU.
Please let me know if you need any more information.

from landing-zone-accelerator-on-aws.

Thank you @cloudgury for validating renaming OU registered with Control Tower.

If an OU registered with ControlTower is manually renamed, the ControlTower console displays the updated OU name, but the ControlTower GetLandingZone API shows the old OU name. Due to this issue, LZA attempts to enable baseline for the given OU, which causes pipeline to fail with "The baseline 'AWSControlTowerBaseline' cannot be enabled on the Security OU."

As a workaround, you have the following options:

• You can rename the OU back to its previous name. However, if this is not possible, proceed to the next option.
• You can add the ACCELERATOR_NO_ORG_MODULE environment value to the "AWSAccelerator-ToolkitProject" CodeBuild project with the value set to "Yes". If this environment variable is set, LZA will skip OU baseline API calls. This feature is available in LZA v1.8.0 or later. Please note: When the ACCELERATOR_NO_ORG_MODULE environment variable parameter is set to "Yes", LZA will not register OUs with the Control Tower APIs. Therefore, you will need to manually manage OU registration.

Let us know if this workaround works for you and if you have any further questions.

from landing-zone-accelerator-on-aws.