Introduction to AWS Organizations

AWS Organizations is a governance service that enables centralized management of multiple AWS accounts. It helps organizations control, monitor, and standardize account usage from a single management account.

• It Allows creation and consolidation of multiple AWS accounts.
• Enables centralized governance using policies and controls.
• It Supports resource sharing and consolidated management.
• Simplifies logging, auditing, and account-level management.

Components of AWS Organizations

The following are important components of AWS Organization:

Management/Master account:

• This is the master account in AWS Organizations that has all the administrative rights for all accounts under that particular AWS Organization.
• It is used to centrally manage all accounts and handle the billing and logs of all accounts in the Organization.

Member account:

• The accounts in AWS Organization other than the Master account are called member accounts.
• These can be existing accounts or new accounts added to AWS Organization.

Organization Units (OU):

• The unit in which all accounts are grouped are called Organization Units (OU).
• Multiple OUs can be created in an Organization, and they can be nested within each other.

Policies:

• AWS Organization provides various policies that help in restricting or setting boundaries for each account.
• The most important policy provided is the Service Control Policy (SCP). We'll discuss this in a little more detail ahead.

AWS Organizations Policies

AI services opt-out policies: If it is enabled, it allows AI services to store and use your content.

Backup policies: These are used to enable organization-wide plans for backup to help in compliance. It helps you in maintaining consistency.

Service Control Policies:

• Service Control Policies (SCPs) define the maximum permissions that IAM users and roles can have in member accounts. They do not grant permissions themselves and do not apply directly to resources.
• SCPs affect all IAM entities in a member account, including the root user, but do not apply to the management account.

Tag policies: These are used to set standards for resources that are tagged in AWS. Users can define the tag keys and their allowed values in this policy.

Service Control Policies (SCP)

Service Control Policies (SCPs) are used with AWS Organizations to define the maximum permissions that IAM users and roles can have in member accounts. SCPs do not grant permissions by themselves and do not apply directly to AWS resources. Instead, they act as guardrails, limiting what actions identities can perform within an account.

SCPs affect:

• All IAM users and roles in member accounts, including the root user
• All accounts within an Organizational Unit (OU) where the SCP is applied

SCPs do not apply to the management account.

Once an SCP is applied, IAM users and roles in that account can perform only the actions that are explicitly allowed by both:

• Their identity-based IAM policies
• The Service Control Policy

If an action is not allowed by the SCP, it is denied, even if an IAM policy allows it.

SCPs are commonly used to:

• Restrict access to specific AWS services
• Prevent risky actions (e.g., deleting logging resources)
• Enforce organization-wide security and compliance standards

Service Control Policies can be managed in the AWS Management Console under:
AWS Organizations → Policies → Service Control Policies

Features of AWS Organization

The following are some features of AWS Organization:

• Centralized Management: Users can link all accounts into a single organization and centrally manage them. Users can add new or existing accounts in AWS into Organizations.
• Central billing for all accounts: The billing of each resource utilized in accounts present in AWS Organizations can be done from one master account. This saves a lot of time and effort.
• Grouping of accounts: Accounts can be grouped in AWS Organizations, either normally or in a hierarchical form. Users can create different Organization Units (OU) with different access levels and can nest OUs inside each other.
• Policies: Users can set policies in AWS Organizations to set boundaries for each account and restrict their activities according to their role.
• Integration with IAM service: AWS Organizations can be integrated with AWS Identity and Access Management (IAM) to set up roles for users and accounts.
• Integration with other AWS services: AWS Organization can be integrated with other AWS services like AWS backup, CloudTrail, etc.
• Free to use: Setting up and using AWS Organization is free of charge. The user is only charged for the resources used by each account.
   

Advantages of Using Organizations

The following are some advantages of using AWS Organizations:

• Quick Scaling of your environments: Using AWS Organizations, users can quickly scale their environment by adding and grouping new accounts. Users can add new accounts to a group and create fresh ones programmatically, owing to the Organization's APIs. The new account will instantly be covered by the group's policies.
• Grouping accounts: Accounts can be grouped in a systematic and hierarchical way which makes them easy to use.
• Efficiently provision resources across accounts: Instead of using duplicate resources for different accounts using AWS Resource Access Manager (RAM) with AWS Organization, users can share resources between accounts in that Organization.
• Centrally manage and govern multiple accounts: Users can have master accounts having admin access and can manage all accounts inside that Organization centrally.
• Set limits to what users can do using SCP's: The user has the option to set policies in AWS Organization which helps in setting boundaries and restricting each account.
• Manage costs and logs centrally: Billing and logs of each account inside AWS Organizations can be handled centrally and in a consolidated manner.

Use Cases of AWS Organizations

The following are important use cases of AWS Organization:

1. Grouping various accounts in AWS.
2. Restricts access to accounts via a single account.
3. Billing and costs are to be checked and paid via a single account, i.e. centrally.
4. Share resources between various accounts.
5. Set up prod or dev or foundation OU accounts.
6. Set up accounts in a hierarchical or nested manner.

AWS Organizations – Region Support

AWS Organizations – Billing and Pricing

The following table shows the billing and pricing of AWS Organization: