AWS Organizations
Central management of multiple AWS accounts — grouping, governance policies, and one consolidated bill.
Verified against AWS documentation · 2026-08-28
Key facts
- 01One management account owns the org; everything else is a member account — the management account can never be restricted by SCPs
- 02Accounts are grouped into OUs under a single root, nested up to 5 levels deep; policies attached higher up flow down to everything beneath
- 03SCPs are guardrails, not grants — they set the maximum possible permissions but never give anyone access; IAM still has to allow the action
- 04Consolidated billing: one bill for all accounts, usage pooled for volume discounts, and Reserved Instances / Savings Plans shared across accounts by default
- 05Two modes: consolidated billing only, or all features (required for SCPs and most governance) — all features is the exam default assumption
Exam triggers
Phrases and scenarios that point here.
- "Multiple accounts", "centrally manage", "single bill", "volume discounts across accounts"
- Restrict what member accounts can do, even their root users → SCP
- New accounts created automatically with guardrails already applied → Organizations + OUs
- Share Reserved Instance or Savings Plans discounts across accounts → consolidated billing
- An SCP denies it → nothing in that account can do it, not even an admin with full IAM permissions
Not this service
- Prescriptive multi-account setup with a landing zone and pre-built guardrails → AWS Control Tower (built on top of Organizations)
- Permissions for users and roles within one account → IAM
- Sharing resources (subnets, Transit Gateways) between accounts → AWS RAM
Use cases
- 01Separate accounts for dev, staging, and prod under one org — a blast radius boundary, so a leaked dev credential can't touch production
- 02Sandbox OU with an SCP denying expensive services, so an intern can experiment without accidentally launching a p5 instance
- 03Deny-region SCP pinning workloads to approved Regions for data residency — think of it as a fence the whole org lives inside
- 04One finance team paying a single bill while fifty engineering teams each own their account, with pooled usage unlocking volume discount tiers nobody hits alone
- 05Org-wide CloudTrail trail from the management account, so member account admins can't switch off their own audit logging
How it's charged
- 01Free — no charge for the org, OUs, policies, or account management
- 02You pay only for the AWS resources running inside each member account, rolled into the management account's consolidated bill
