AWS Organizations

AWS Organizations is a control-plane service for centrally creating and managing multiple AWS accounts, grouping them into organizational units (OUs), and applying organization-wide policies. It provides consolidated billing and policy-based guardrails such as Service Control Policies (SCPs). It normally sits at the organization-level to enforce governance across accounts rather than inside a single AWS account or VPC.

🗂 Resource Category

Management and Governance • Security, Identity, and Compliance

🧠 Exam Memory Hook

Think: "Central account management + org-level guardrails = AWS Organizations"

📖 Ownership

Classification: AWS Managed Service

AWS responsibilities: AWS operates, secures, maintains, and patches the AWS Organizations control plane and the underlying AWS infrastructure that runs the service; AWS provides the APIs, management console integration, and service availability. AWS is responsible for the high-level service platform, durability of service metadata, and protection of the control plane infrastructure. AWS does not manage account-level resources, account identities, or customer workloads within member accounts.

Customer responsibilities: The customer configures organizational structure, Organizational Units, Service Control Policies, tag policies, account creation and lifecycle, billing preferences, and delegated administrators; the customer secures and monitors IAM identities and resources within each account and ensures policies applied through Organizations do not unintentionally restrict required permissions. The customer also configures integrations with other services, reviews audit logs, and maintains application and OS-level patching inside member accounts.

Patching responsibilities: AWS patches and maintains the physical infrastructure and the Organizations managed control-plane software. AWS patches the hypervisor and underlying managed runtime where applicable. Guest operating system, customer-managed runtimes, libraries, dependencies, and customer-deployed applications inside member accounts are the customer's responsibility to maintain and patch. If an integrated AWS service requires its own patching model, that service's responsibilities apply independently.

🏗 Typical Architecture

💡 Top 5 Features

Centralized account creation and management within a single organization.
Organizational Units to group and apply policies across sets of accounts.
Service Control Policies (SCPs) to define permission guardrails at the organization or OU level.
Consolidated billing to aggregate charges and manage a single payment method for all member accounts.
Policy types and trusted service access that enable delegated administration and integrations with other AWS services.

✅ Top 5 Use Cases

Implement multi-account governance by grouping accounts into OUs and applying SCPs to enforce broad permission boundaries.
Centralize billing and payment management for multiple accounts to simplify finance operations and cost allocation.
Automate account provisioning and lifecycle management in conjunction with Control Tower or CloudFormation StackSets.
Enforce organizational tagging rules and policy-based controls across accounts using tag policies and SCPs.
Delegate administrative responsibilities by registering delegated administrators for supported AWS services.

🏗 Architecture Placement

AWS Organizations is an organization-level control plane that is global (not regional) and manages multiple AWS accounts; management account administrators and delegated administrators call its APIs or use the console. It applies policies and controls that affect member accounts, and integrates with account-level services such as IAM, CloudTrail, and billing systems. It does not run inside a VPC and does not host customer workloads.

🎯 Commonly Used With

- AWS Identity and Access Management
- AWS CloudTrail
- AWS Config
- AWS Control Tower
- AWS CloudFormation

🌍 5 Real-World Examples

A bank organizes production, sandbox, and shared services accounts into separate OUs and applies SCPs to restrict actions for regulatory compliance.
A healthcare provider centralizes billing across many accounts while isolating PHI workloads into specific OUs for tighter governance.
A retail company uses Organizations with Control Tower to provision standardized landing zones and enforce baseline security policies across accounts.
A government agency segregates workloads by project and applies OU-level guardrails to meet accreditation and audit requirements.
A technology platform team delegates administration to service teams by registering delegated administrators and automating account creation.

🎓 AWS Exam Clues

Use when you must manage multiple AWS accounts centrally and apply organization-wide guardrails.
Service Control Policies define maximum permissions and can restrict actions even if IAM permits them.
Consolidated billing is used to aggregate costs and assign a single payer account for multiple member accounts.
Organizational Units let you group accounts for policy inheritance and targeted policy application.
AWS Organizations manages account-level structure and policies but does not replace IAM for identity and resource permissions within accounts.

📝 Quick Revision

AWS Organizations provides a global control plane for centrally managing multiple AWS accounts, applying SCPs, and consolidating billing. Use it when you need account-level separation, centralized governance, and delegated administration; consider SCP evaluation order, management account responsibilities, and integration with IAM and audit services.

🏷 Keywords

management account • organizational unit • service control policy • SCP • consolidated billing • trusted access • organization root • tag policy • delegated administrator • account creation • policy inheritance • cross-account management