Reset the landing zone to resolve drift

When you create your landing zone, the landing zone and all the organizational units (OUs), accounts, and resources are compliant with the governance rules enforced by your chosen controls. As you and your organization members use the landing zone, changes in this compliance status may occur. These changes are called drift.

To identify if your landing zone is in drift, you can call the GetLandingZone API. This API returns the landing zone's drift status of DRIFTED or IN_SYNC.

To resolve drift within your landing zone you can use the ResetLandingZone API to reset the landing zone back to its original configuration. For example, AWS Control Tower enables IAM Identity Center by default to help you manage your AWS accounts-- but if you configure your original landing zone parameters with IAM Identity Center disabled, calling ResetLandingZone maintains that disabled IAM Identity Center configuration.

You can use the ResetLandingZone API only if your landing zone is on version 3.1 or later. You can call the GetLandingZone API to check your current landing zone version. If your landing zone is on a version earlier than 3.1, the ResetLandingZone API is not available. In that case, Update your landing zone to at least version 3.1. The update process resolves drift on its own, so you do not need to reset separately. Resetting your landing zone does not upgrade it to the latest available version.

Output:

{
   "operationIdentifier": "55XXXXXX-e2XX-41XX-a7XX-446XXXXXXXXX"
}