AWS Organizations & Multi Account Strategy
7 questions found
What is AWS Organizations and what benefits does it provide for managing multiple AWS accounts?
Beginner
AWS Organizations lets you centrally manage and govern multiple AWS accounts from a single management account, providing benefits such as consolidated billing across all accounts, the ability to apply organization wide policies for security and compliance, and simplified account creation, making it much easier to manage a growing number of AWS accounts compared to treating each one as a completely separate, disconnected entity.
aws organizations create-organization --feature-set ALL
Real-world example
A company that started with a single AWS account creates an AWS Organization as it grows, adding separate accounts for development, staging, and production while managing all of their billing and security policies from one central place.
Common follow-ups: What is the difference between consolidated and all features mode in AWS Organizations?;How do you invite an existing AWS account to join an organization?
AWS Cost Management & Billing;IAM
Why do organizations commonly adopt a multi account strategy instead of running all workloads within a single AWS account?
Beginner
A multi account strategy provides strong isolation between different environments or teams, limiting the blast radius of any security incident or misconfiguration to a single account rather than potentially affecting an entire organization's resources, simplifies cost tracking and allocation per team or project, and allows different accounts to have completely independent security policies and resource limits appropriate for their specific purpose, such as a more restrictive policy for a production account compared to a development sandbox account.
aws organizations create-account --email dev-team@example.com --account-name 'Development Account'
Real-world example
A company separates its production workloads into their own dedicated AWS account, ensuring that a misconfiguration or security incident in a developer's sandbox account can never directly impact the production environment serving real customers.
Common follow-ups: How many separate accounts does a typical mature organization usually end up managing?;What is the tradeoff between having very granular accounts versus fewer, broader accounts?
IAM;AWS Cost Management & Billing
What are Organizational Units in AWS Organizations, and how do they help structure a large number of accounts logically?
Intermediate
Organizational Units, commonly called OUs, let you group related accounts together into a hierarchical structure, such as grouping all production accounts under one OU and all development accounts under another, and this structure is important because policies like service control policies can be applied at the OU level, automatically affecting every account within that group, making it much easier to manage governance consistently across many accounts that share similar requirements.
aws organizations create-organizational-unit --parent-id r-abc123 --name 'Production'
Real-world example
A large enterprise organizes its fifty AWS accounts into a Production OU, a Development OU, and a Sandbox OU, then applies a stricter service control policy to the Production OU alone, without needing to configure that same restriction individually on each production account.
Common follow-ups: Can Organizational Units be nested within other Organizational Units?;How do you decide the right grouping structure for organizational units?
IAM;Tagging Strategies & Resource Management
What are Service Control Policies, and how do they enforce security and compliance guardrails across an entire organization?
Intermediate
Service Control Policies, or SCPs, define the maximum available permissions for accounts within an organization or organizational unit, meaning even if an individual account's IAM policies would otherwise allow an action, an SCP can explicitly deny that action organization wide, providing a powerful centralized guardrail mechanism, such as preventing any account from disabling CloudTrail logging or launching resources outside of approved regions, regardless of what permissions individual account administrators might otherwise grant.
aws organizations create-policy --content file://deny-region-policy.json --type SERVICE_CONTROL_POLICY --name RestrictRegions
Real-world example
A company applies a Service Control Policy across its entire organization that prevents any account from launching resources outside of two approved regions, ensuring compliance with data residency requirements even if an individual account administrator mistakenly tries to deploy elsewhere.
Common follow-ups: What is the difference between an SCP and a regular IAM policy in terms of what they can grant versus restrict?;What happens if an SCP conflicts with an IAM policy granting the same action?
AWS Global Infrastructure (Regions
AZs & Edge Locations);IAM
What is the AWS Landing Zone or AWS Control Tower, and how does it help set up a well architected multi account environment quickly?
Intermediate
AWS Control Tower automates the setup of a secure, well governed multi account AWS environment based on established best practices, automatically configuring a management account, foundational organizational units for production and other purposes, centralized logging and auditing, and a set of preventive and detective guardrails, significantly reducing the time and expertise required to establish a solid multi account foundation compared to manually configuring AWS Organizations, IAM, and CloudTrail from scratch.
aws controltower create-landing-zone --manifest file://landing-zone-manifest.json
Real-world example
A company setting up a new multi account AWS environment uses Control Tower to automatically establish foundational security guardrails and account structure within hours, rather than spending weeks manually configuring each individual security and governance component themselves.
Common follow-ups: What guardrails does Control Tower enable by default?;How does Control Tower relate to AWS Organizations underneath the surface?
AWS Config;AWS Security Hub & GuardDuty
How can cross account IAM roles enable secure resource sharing and centralized management across accounts within an organization?
Advanced
Cross account IAM roles let a user or service in one account temporarily assume a role defined in another account, gaining exactly the permissions granted by that role without needing separate long lived credentials for every account, which is commonly used to allow a central security team to audit resources across all accounts, or to let a CI/CD pipeline running in a shared tooling account deploy resources into separate development and production accounts securely.
aws sts assume-role --role-arn arn:aws:iam::PRODUCTION_ACCOUNT_ID:role/CentralAuditRole --role-session-name audit-session
Real-world example
A central security team uses cross account roles to assume read only audit permissions across every account in the organization from a single central account, without needing separate credentials or user accounts created individually in each of those fifty accounts.
Common follow-ups: How do you establish the trust relationship required for cross account role assumption?;What is the difference between cross account roles and resource based policies for sharing access?
IAM;AWS Cost Management & Billing
How should an organization design its overall account structure and governance model to balance security isolation with developer agility and operational efficiency?
Advanced
An effective account structure balances strict isolation for genuinely sensitive workloads, such as a completely separate production account with tightly restricted access, against the practical need for developer agility, often achieved by giving development teams broader permissions within their own dedicated sandbox or development accounts where mistakes have limited blast radius, while relying on centralized guardrails through Service Control Policies, shared logging accounts, and automated compliance monitoring to maintain organization wide security visibility without requiring every single team decision to be centrally approved, which would otherwise slow down development significantly.
aws organizations create-policy --content file://balanced-guardrail-policy.json --type SERVICE_CONTROL_POLICY --name BaselineGuardrails
Real-world example
A technology company gives its development teams significant autonomy within their own sandbox accounts to experiment freely, while enforcing a small set of non negotiable baseline security guardrails organization wide through Service Control Policies, striking a practical balance between security and development speed.
Common follow-ups: How do you measure whether an organization's governance model is too restrictive or too permissive?;What role does regular governance review play as an organization's needs evolve over time?
Well-Architected Framework;IAM