AWS Organizations

What it is

AWS Organizations lets you manage many AWS accounts centrally as one organization. You create or invite accounts, group them into organizational unitsOU (Organizational unit)A group of AWS accounts inside an organization in AWS Organizations. OUs can contain other OUs, and policies attached to an OU, such as SCPs, apply to every account in it.Glossary entryClose (OUs), apply policies that set guardrails for every account in an OU, and pay for everything with one consolidated bill. Organizations is offered at no additional charge.

Choose Organizations when a question involves multiple accounts: limiting what accounts can do, sharing discounts, central billing, or turning on a security service across every account. For a ready-made, governed multi-account setup built on Organizations, see AWS Control Tower.

Concepts

• Management account: the account that creates the organization. It pays all charges, creates and invites accounts, and manages policies. Keep it for organization management only, not for workloads.
• Member accounts: every other account in the organization.
• Root and OUs: the root is the top container. OUs group accounts, for example Security, Production, and Sandbox, and can be nested up to five levels deep. Policies attached to the root or an OU apply to everything below it.
• Feature sets: all features (the default and recommended), or consolidated billing only, which supports billing but not policies. An organization can move from billing-only to all features once every member account approves.

Policies

Authorization policies set the maximum permissions:

• Service control policies (SCPsSCP (Service control policy)An AWS Organizations policy that sets the maximum permissions for IAM users and roles in member accounts. It grants nothing by itself, and it does not apply to the management account.Glossary entryClose) limit the maximum available permissions for IAM users and roles in member accounts, including the account's root user.
  • An SCP never grants permissions; IAM policies still have to allow the action. The effective permissions are the intersection of what the SCPs allow and what IAM allows.
  • SCPs don't affect the management account or service-linked roles.
  • By default the FullAWSAccess SCP is attached everywhere. Use deny statements to block actions, or replace it with an allow list of services. Evaluation is deny by default: an action must be allowed at every level, from the root through each OU to the account.
• Resource control policies (RCPsRCP (Resource control policy)An AWS Organizations policy that sets the maximum permissions on resources in member accounts, such as S3 buckets and KMS keys, whoever requests access. Like an SCP, it grants nothing by itself.Glossary entryClose) limit the maximum available permissions for resources in member accounts, including access by principalsPrincipalA person or workload that can make requests to AWS, such as an IAM user, a role session, the root user, a federated user, or an AWS service. Resource-based policies name the principals they allow.Glossary entryClose outside the organization.

Other policy types manage configuration:

• Declarative policies (such as for EC2) enforce a service configuration and keep it in place as the service adds features.
• Backup policies apply AWS Backup plans across accounts.
• Tag policies standardize tags.
• AI services opt-out policies control data collection by AWS AI services.
• Further types cover chat applications and Security Hub.

Consolidated billing

• The management account receives one bill for all member accounts and can track charges per account.
• Usage is combined across accounts, so the organization shares volume pricing tiers, Reserved InstanceRI (Reserved Instance)A billing discount for committing to an instance type in a Region or Availability Zone for one or three years. It is not an instance: running instances that match are billed at the lower rate. AWS now recommends Savings Plans instead.Glossary entryClose discounts, and Savings Plans.

Working across accounts

• Accounts created through Organizations get an IAM role, by default named OrganizationAccountAccessRole, that administrators in the management account can assume.
• Delegated administrators: let a member account, such as a security account, manage an integrated service for the whole organization.
• Centralized root access: secure or delete the root user credentials of member accounts centrally, and run the few root-only tasks from the management account.
• Integrated services can be turned on organization-wide, for example:
  • CloudTrail organization trails and Config aggregators.
  • IAM Identity Center for single sign-onSSO (Single sign-on)Signing in once to reach many applications or accounts without signing in to each again. AWS IAM Identity Center provides single sign-on to AWS accounts and applications.Glossary entryClose.
  • AWS RAM for resource sharing.
  • AWS Backup.
  • GuardDuty, Security Hub, and Firewall Manager.

Security, resilience, performance, and cost

Security

• Use SCPs to deny risky actions everywhere:
  • Leaving the organization.
  • Turning off CloudTrail or GuardDuty.
  • Using unapproved RegionsAWS RegionA separate geographic area where AWS runs its services, such as us-east-1 in Northern Virginia, made up of several Availability Zones. Most resources live in one Region; you choose Regions for latency, data residency, and the services you need.Glossary entryClose: deny requests whose aws:RequestedRegion isn't an approved Region, and exempt global services such as IAM, CloudFront, and Route 53 with NotAction.
• To let every account in the organization, including accounts added later, use a resource such as an S3 bucket, add the aws:PrincipalOrgID condition key to the resource policy. Listing account IDs needs an edit for every new account, and an SCP can't grant the access.
• Use RCPs to block access to resources from outside the organization.
• Protect the management account with MFAMFA (Multi-factor authentication)Signing in with two or more different kinds of proof, such as a password plus a code from a phone app or a security key. AWS recommends MFA for the root user and for every human user.Glossary entryClose, keep workloads out of it, and centralize root access.

Resilience

• Separate workloads into accounts and OUs (for example production and development), so a mistake or a compromise in one account stays contained.

Cost

• Organizations itself is free. Consolidated billing shares volume discounts, Reserved Instances, and Savings Plans across accounts.

Organizations or another option?

If the requirement is	Choose
Restrict what IAM principals in member accounts can do	Organizations SCPs
Restrict access to resources from outside the organization	Organizations RCPs
Let all current and future accounts in the organization use a bucket	Bucket policy with aws:PrincipalOrgID
One bill and shared discounts across accounts	Consolidated billing
A governed landing zone with controls, set up for you	AWS Control Tower
Single sign-on to many accounts	IAM Identity Center
Share subnetsSubnetA range of IP addresses in a VPC, inside one Availability Zone. A subnet is public when its route table sends internet traffic to an internet gateway, and private when it does not.Glossary entryClose or other resources between accounts	AWS RAM

Reverse mindmap: when the question points here

• Yes, when the question says
  • Manage many AWS accounts centrally→ leads to Organizations
  • One bill for all accounts→ leads to Consolidated billing
  • Share RI and Savings Plans discounts across accounts→ leads to Consolidated billing
  • Group accounts by environment or team→ leads to OUs
• Set guardrails
  • Block a service or Region in member accounts→ leads to SCP
  • Allow only approved Regions, keep global services→ leads to SCP deny on aws:RequestedRegion
  • Bucket open to every account in our organization→ leads to aws:PrincipalOrgID condition
  • Prevent leaving the organization or disabling CloudTrail→ leads to SCP deny
  • Even the member account root user must be restricted→ leads to SCP
  • Block outside access to our resources→ leads to RCP
  • Enforce EC2 settings everywhere→ leads to Declarative policy
  • Standard tags across accounts→ leads to Tag policy
  • Backup plans in every account→ leads to Backup policy
• Know the limits
  • SCPs on the management account→ leads to No effect
  • SCP alone grants access→ leads to Never, IAM must allow too
• No, when the question says
  • Pre-built governed landing zone→ leads to Control Tower

Key takeaways

• Organizations groups accounts into OUs under one management account, for free.
• SCPs set maximum permissions for IAM users and roles in member accounts; they never grant permissions and don't affect the management account or service-linked roles.
• RCPs set maximum permissions on resources; declarative, backup, and tag policies manage configuration.
• Consolidated billing gives one bill and shares volume discounts, Reserved Instances, and Savings Plans.
• Use delegated administrators, centralized root access, and organization-wide integrations such as CloudTrail, Config, and IAM Identity Center.

Sources

• AWS Organizations User Guide: What is AWS Organizations?
• AWS Organizations User Guide: Terminology and concepts
• AWS Organizations User Guide: Managing organizational units (OUs)
• AWS Organizations User Guide: Quotas and service limits
• AWS Organizations User Guide: Managing organization policies
• AWS Organizations User Guide: Service control policies (SCPs)
• AWS Organizations User Guide: SCP evaluation
• IAM User Guide: AWS: Denies access to AWS based on the requested Region
• IAM User Guide: AWS global condition context keys
• AWS Organizations User Guide: Resource control policies (RCPs)
• AWS Organizations User Guide: Declarative policies
• AWS Organizations User Guide: Backup policies
• AWS Organizations User Guide: Tag policies
• AWS Organizations User Guide: AI services opt-out policies
• AWS Organizations User Guide: Accessing member accounts
• AWS Organizations User Guide: Delegated administrator
• AWS Organizations User Guide: Best practices for the management account
• AWS Organizations User Guide: AWS services that you can use with AWS Organizations
• AWS Billing User Guide: Consolidating billing for AWS Organizations
• IAM User Guide: Centralize root access for member accounts
• AWS Organizations FAQs