When to update AWS Control Tower OUs and accounts - AWS Control Tower
This documentation is a draft for private preview for regions in the AWS European Sovereign Cloud. Documentation content will continue to evolve. Published: December 31, 2025.

When to update AWS Control Tower OUs and accounts

When you perform a landing zone update, you must update your enrolled accounts to apply new controls to those accounts.

  • You can perform an update to all accounts under an OU using the Re-Register or Reset option.

  • If you have more than one registered OU in your landing zone, re-register or reset all of your OUs to update all of your accounts.

  • To update a single account, you can update from the AWS Control Tower console, or you can select the Update provisioned product option in AWS Service Catalog if AWSControlTowerBaseline is enabled on the account. See Update the account in the console.