AWS Organizations
Manage multiple accounts
Groups multiple AWS accounts into one organization: consolidated billing, grouping (OUs), and permission guardrails (SCPs).
- Cost$ Low
- Difficulty●●●●●
- Costs money when idle?No
- Managed by AWS
- In examsCLF · SAA · SOA
Think of it asLike a parent company managing its subsidiaries and setting common rules.
Where does Organizations fit?
OrganizationsOrganizations calls
A real example, step by step
- The company has separate accounts for dev, test, production and each department, with bills scattered everywhere.
- You create an organization in AWS Organizations, invite the accounts and group them into OUs: Production, Development, Sandbox.
- An SCP on the Sandbox OU blocks every region except Singapore and forbids expensive instance types.
- Even administrators inside Sandbox accounts can't get around that SCP.
- At month end the management account receives one combined bill, with usage pooled for better pricing.
When to use it
✓ Use it when
You have 2 or more accounts (separate dev/prod, per team).
Common uses
- Separate dev / staging / prod accounts
- Centralized billing, sharing Savings Plans/RI discounts
- Apply SCPs to block unused Regions or services
Organizations, IAM or IAM Identity Center?
| Organizations |  IAM |  IAM Identity Center | |
|---|---|---|---|
| Scope | Many accounts | One account | Sign-in to many accounts |
| Permission control | SCPs: a maximum ceiling, grant nothing | Policies: grant specific permissions | Permission sets: temporary access |
| Billing | One consolidated bill | No | No |
| Cost | Free | Free | Free |
What does it cost?
- Pricing model: Free.
- Free tier: Free.
No traps; on the contrary, it saves money by consolidating bills to get tiered pricing.
Block regions or services for a group of accounts, even for admins → SCPs. SCPs don't grant permissions; they only limit them. Set up a governed multi-account environment → Control Tower. Enable GuardDuty/CloudTrail/Config for the whole organization from one place.
Try real exam questions
1A company uses AWS Organizations to create dedicated AWS accounts for each business unit to manage each business unit's account independently upon request. The root email recipient missed a notification that was sent to the root user email address of one account. The company wants to ensure that all future notifications are not missed. Future notifications must be limited to account administrators. Which solution will meet these requirements?
- AConfigure the company's email server to forward notification email messages that are sent to the AWS account root user email address to all users in the organization.
- BConfigure all AWS account root user email addresses as distribution lists that go to a few administrators who can respond to alerts. Configure AWS account alternate contacts in the AWS Organizations console or programmatically.
- CConfigure all AWS account root user email messages to be sent to one administrator who is responsible for monitoring alerts and forwarding those alerts to the appropriate groups.
- DConfigure all existing AWS accounts and all newly created accounts to use the same root user email address. Configure AWS account alternate contacts in the AWS Organizations console or programmatically.
Show answer
Correct answer: B
Make each account's root email a distribution list that goes to a few administrators, and configure alternate contacts in AWS Organizations. Using the same root email for every account isn't allowed.
2A company's cloud operations team wants to standardize resource remediation. The company wants to provide a standard set of governance evaluations and remediations to all member accounts in its organization in AWS Organizations. Which self-managed AWS service can the company use to meet these requirements with the LEAST amount of operational effort?
- AAWS Security Hub compliance standards
- BAWS Config conformance packs
- CAWS CloudTrail
- DAWS Trusted Advisor
Show answer
Correct answer: B
AWS Config conformance packs bundle rules and remediations and deploy them once to every account in the organization. Trusted Advisor and CloudTrail don't remediate configuration.
Frequently asked questions
What is consolidated billing?
The management account receives one bill for all member accounts. Usage is combined to reach volume pricing tiers, and Reserved Instances and Savings Plans can be shared across accounts.
Does AWS Organizations cost anything?
There is no charge. You only pay for the resources that member accounts use.
What do AWS exams ask about Organizations?
Using SCPs to block regions or services that aren't allowed, grouping accounts into OUs, consolidated billing, Control Tower to set up a governed multi-account environment, and enabling services such as CloudTrail or GuardDuty for the whole organization.