AWS controltower: Rename Control Tower launch path error to Account Factory portfolio error
Summary
Renames the 'No Launch Paths Found Error' troubleshooting section to 'AWS Control Tower Account Factory portfolio error' and adds a new error message indicating the user's IAM identity lacks access to the Account Factory portfolio in Service Catalog, with guidance that an administrator must associate the identity with the portfolio.
Security assessment
The added text is troubleshooting guidance for an IAM/Service Catalog portfolio access error, describing how an administrator grants an identity access. It is security-adjacent (IAM permissions) but does not address a specific vulnerability or document a security feature/best practice.
Evidence
+`Your AWS IAM identity does not have access to the AWS Control Tower Account Factory portfolio in AWS Service Catalog. To resolve this, an administrator must associate your AWS IAM identity with the portfolio.`
Diff
diff --git a/controltower/latest/userguide/troubleshooting.md b/controltower/latest/userguide/troubleshooting.md index 87271b7c7..1045b5917 100644 --- a//controltower/latest/userguide/troubleshooting.md +++ b//controltower/latest/userguide/troubleshooting.md @@ -7 +7 @@ -Landing Zone Launch FailedLanding Zone Update Failed with KMS ErrorUnable to Update Landing ZoneLanding zone not up to date errorNew Account Provisioning FailedFailed to Enroll an Existing AccountUnable to Update an Account Factory AccountFailure Error that Mentions AWS ConfigNo Launch Paths Found ErrorReceived an Insufficient Permissions ErrorDetective controls are not taking effect on accountsRate exceeded error returned by the AWS Organizations APIFailure to move an Account Factory account directly from one AWS Control Tower landing zone to another AWS Control Tower landing zoneAWS Support +Landing Zone Launch FailedLanding Zone Update Failed with KMS ErrorUnable to Update Landing ZoneLanding zone not up to date errorNew Account Provisioning FailedFailed to Enroll an Existing AccountUnable to Update an Account Factory AccountFailure Error that Mentions AWS ConfigAWS Control Tower Account Factory portfolio errorReceived an Insufficient Permissions ErrorDetective controls are not taking effect on accountsRate exceeded error returned by the AWS Organizations APIFailure to move an Account Factory account directly from one AWS Control Tower landing zone to another AWS Control Tower landing zoneAWS Support @@ -31 +31 @@ If you encounter issues while using AWS Control Tower, you can use the following - * No Launch Paths Found Error + * AWS Control Tower Account Factory portfolio error @@ -344 +344 @@ Here are some example AWS Config CLI commands you can use to determine the statu -## No Launch Paths Found Error +## AWS Control Tower Account Factory portfolio error @@ -346 +346 @@ Here are some example AWS Config CLI commands you can use to determine the statu -When you're trying to create a new account, you may see an error message similar to this one: +When you're trying to create, enroll, or update an account, you may see one of the following error messages: @@ -348 +348 @@ When you're trying to create a new account, you may see an error message similar -`No launch paths found for resource: prod-dpqqfywxxxx` +`Your AWS IAM identity does not have access to the AWS Control Tower Account Factory portfolio in AWS Service Catalog. To resolve this, an administrator must associate your AWS IAM identity with the portfolio.` @@ -350 +350,3 @@ When you're trying to create a new account, you may see an error message similar -This error message is generated by AWS Service Catalog, which is the integrated service that helps provision accounts in AWS Control Tower. +or + +`No launch paths found for resource: prod-`xxxx``