AWS Control Tower Usage Account Onboarding

Note: We recommend not onboarding the management account as a usage account

While Onboarding Usage Account you need to follow the sequence below

Audit
Log Archive
Other remaining accounts

Why this matters: Control Tower's Audit and Log Archive accounts hold the centralized logging and compliance data other accounts depend on — onboarding them first avoids gaps in that dependency chain.

At the time of onboarding other remaining usage accounts (point 3), log in using the respective AWS account rather than the SSO account

Click on below link to onboard the AWS Control Tower Usage Account

AWS Member Account Onboarding

Troubleshooting

If accounts are not discovered, confirm that the Control Tower setup and required stack resources completed successfully.
If a permission error appears, verify the AWS role and policy configuration described above.

FAQs

Should I onboard the master/management account as a usage account?
No — this is explicitly not recommended. Onboard Audit, Log Archive, and the other member accounts instead.

Which login should I use when onboarding the remaining accounts (step 3)?
Log in using the respective AWS account directly, not the SSO account — using SSO at that step is a common mistake worth avoiding.