Question

A large enterprise deployed AWS Control Tower to establish its multi-account landing zone. A platform engineering team, wanting to add a custom deny policy, manually attached a new Service Control Policy directly to a Control Tower-managed Organizational Unit using the AWS Organizations console. Weeks later, the Control Tower dashboard reports the OU and its accounts as 'Not compliant' / drifted, and the team is concerned that a future landing zone update could break their custom guardrail. What is the recommended approach to maintain the custom SCP while keeping Control Tower governance intact?

Accepted Answer

Detach the manually created SCP and re-implement the control as a Control Tower custom guardrail using Customizations for Control Tower (CfCT) or by managing it through Control Tower-supported mechanisms, then re-register the OU to clear drift.

Answer

Leave the SCP attached directly in AWS Organizations and disable Control Tower drift detection so the dashboard stops reporting the OU as non-compliant.

Answer

Remove the OU from Control Tower governance entirely and manage all its accounts manually through AWS Organizations to avoid conflicts with the landing zone.

Answer

Move all accounts out of the drifted OU into the Root so the SCP applies organization-wide and Control Tower no longer manages those accounts.