AWS Organizations

AWS Organizations lets you manage many AWS accounts from one central place. Companies create separate accounts for teams, projects, and environments. Organizations groups those accounts, applies shared rules, and combines their bills.

Think of a school with many classrooms. Every classroom has its own door, its own supplies, and its own teacher. The principal sets school-wide rules and receives a single budget report. AWS Organizations plays the principal, and each AWS account is a classroom.

Why Use Multiple Accounts

  • An account is the strongest security boundary in AWS. A problem in one account does not spill into another.
  • Separate accounts keep development, testing, and production apart.
  • Costs map clearly to teams and projects.
  • Service limits apply per account, so one busy project cannot exhaust limits for others.
  • Compliance workloads live in tightly controlled accounts.

Core Concepts

  • Organization: the full collection of accounts under one structure.
  • Management account: the account that creates the organization and pays the bills.
  • Member account: any other account in the organization.
  • Organizational unit (OU): a folder that groups accounts, such as Production or Sandbox.
  • Service control policy (SCP): a rule that sets the maximum permissions for accounts in an OU.

Organization Structure

                 Root
                  |
    +-------------+--------------+
    |             |              |
 Security OU   Workloads OU   Sandbox OU
    |             |              |
 Logging      +---+---+       Developer
 Account      |       |       Playground
           Prod    Test
          Account  Account

The management account sits at the top and stays free of workloads. Keep it for billing and organization administration only.

Service Control Policies

An SCP defines guardrails. It never grants permissions by itself. IAM policies still decide what users may do. The effective permission equals the overlap between the SCP and the IAM policy.

 What the SCP allows   : [ A  B  C  D ]
 What IAM policy grants: [ B  C  E    ]
 What the user can do  : [    B  C    ]

Common SCP Uses

  • Block use of AWS regions your company does not operate in.
  • Prevent anyone from disabling CloudTrail or Config.
  • Stop accounts from leaving the organization.
  • Deny actions on expensive services in sandbox accounts.

A sample SCP that blocks deletion of CloudTrail trails looks like this:

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Deny",
      "Action": ["cloudtrail:StopLogging", "cloudtrail:DeleteTrail"],
      "Resource": "*"
    }
  ]
}

SCPs do not affect the management account, which is another reason to keep workloads elsewhere.

Consolidated Billing

Organizations combines usage from all member accounts into one bill. Volume discounts apply to the combined total. Savings Plans and Reserved Instance benefits can be shared across accounts. Cost Explorer breaks spending down by account, so every team sees its own portion.

Creating Accounts Quickly

Organizations creates new member accounts with an API call or a few console clicks. Each new account gets an administrative role that the management account can assume. Automated account creation helps teams launch new projects without waiting on manual setup.

AWS Control Tower

Control Tower builds on Organizations and sets up a recommended multi-account environment. It creates a landing zone with standard OUs, a logging account, and preventive and detective guardrails. Teams that want a ready-made structure often start here.

Sharing Resources and Services

  • AWS Resource Access Manager shares resources such as subnets across accounts.
  • CloudTrail can log every account to one central bucket.
  • IAM Identity Center gives people single sign-on access to many accounts with one login.
  • Delegated administrator accounts let security tools run from a dedicated account.

Practice Steps

  1. Sign in to a practice account and create an organization.
  2. Create two OUs named Dev and Prod.
  3. Invite or create a second account and move it into Dev.
  4. Attach an SCP that denies one action and test the result.
  5. Remove the practice setup when finished.

Best Practices

  • Design OUs around security and policy needs instead of the company's reporting chart.
  • Protect the management account with MFA and a minimal set of administrators.
  • Test SCPs in a sandbox OU before applying them widely.
  • Use tags and account naming rules for clear cost reports.
Previous lesson
Back to course
Next lesson