AWS Organizations, OUs, and Service Control Policies

Learning outcomes

By the end of this lesson, the learner can:

1. Explain what AWS Organizations does and why companies use it.
2. Describe Organizational Units (OUs) and how they group accounts.
3. Explain Service Control Policies (SCPs) and how they differ from IAM policies.
4. Connect Organizations to consolidated billing.

---

Why multiple accounts?

Most companies do not run everything in a single AWS account. Instead, they create separate accounts for different purposes:

• Production account, live customer-facing workloads
• Development account, experimentation and testing
• Security account, centralized logging and audit tools
• Billing account, the management (payer) account

Separate accounts provide blast radius isolation, a misconfiguration in development cannot affect production resources.

---

What AWS Organizations does

AWS Organizations lets you:

1. Create and manage multiple AWS accounts from a central management account
2. Group accounts into Organizational Units (OUs) for logical structure
3. Apply policies (like SCPs) across accounts or OUs
4. Consolidate billing, one bill for all accounts, with potential volume discounts

The account that creates the organization is the management account (formerly called the "master" account). It is the payer and the root of the organization tree.

---

Organizational Units (OUs)

An OU is a container for grouping AWS accounts within an organization. OUs can be nested inside other OUs, forming a tree structure.

Example structure:

Root (Management Account)
├── Production OU
│   ├── Prod-App-A account
│   └── Prod-App-B account
├── Development OU
│   ├── Dev-Team-1 account
│   └── Dev-Team-2 account
└── Security OU
    └── Security-Audit account

Why OUs matter: You can attach policies to an OU, and every account inside that OU inherits the policy. This is much more scalable than managing policies account by account.

---

Service Control Policies (SCPs)

SCPs are permission guardrails that you attach to OUs or individual accounts in AWS Organizations. They define the maximum permissions available to accounts.

Key rules about SCPs

• SCPs do not grant permissions; they only restrict what is allowed
• An action must be allowed by both the SCP and the IAM policy for it to work
• SCPs apply to all IAM users and roles in the affected accounts (including the account's root user)
• SCPs do not affect the management account itself

Example: Region restriction

A common SCP use case is restricting which Regions accounts can use:

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Deny",
      "Action": "*",
      "Resource": "*",
      "Condition": {
        "StringNotEquals": {
          "aws:RequestedRegion": ["us-east-1", "eu-west-1"]
        }
      }
    }
  ]
}

This SCP, attached to the Development OU, would prevent any account in that OU from launching resources outside us-east-1 and eu-west-1.

---

SCPs vs IAM policies

Think of it this way: SCPs set the outer fence. IAM policies define what you can do inside that fence.

---

Connection to consolidated billing

AWS Organizations also provides consolidated billing:

• All accounts in the organization share a single bill
• Usage across accounts is aggregated, which can unlock volume pricing discounts (e.g., S3 or EC2 tiered pricing)
• The management account is the payer

---

Cross-account resource sharing with AWS RAM

AWS Resource Access Manager (RAM) lets you share specific AWS resources with other accounts in your organization (or external accounts) without requiring complex cross-account IAM roles.

What you can share via RAM

• VPC subnets — allow other accounts to launch EC2 instances in your shared subnets
• Transit Gateways — share network connectivity across accounts
• License Manager licenses — share software licenses across your organization
• Route 53 Resolver rules — share DNS resolution configurations

RAM vs cross-account IAM roles

Organizations, OUs, and SCPs define the guardrails. RAM enables practical resource sharing within those guardrails.

---

Summary

• AWS Organizations centrally manages multiple AWS accounts
• OUs group accounts logically (Production, Development, Security, etc.)
• SCPs set maximum permission guardrails across accounts; they restrict, never grant
• Both the SCP and the IAM policy must allow an action for it to succeed
• Organizations also provides consolidated billing with potential volume discounts
• AWS RAM enables cross-account resource sharing (subnets, Transit Gateways, licenses) within organization guardrails
• The management account is the payer and organization root; SCPs do not restrict it

---

Quiz