AWS Organizations

Groups many AWS accounts under one management account, with one bill and shared guardrails.

Think of it as: The building management company that owns every flat.

What to know for Level 0

Consolidated billing: the management account pays one bill for every account, and usage is added together for volume pricing.
An OU (organizational unit) is a folder of accounts. A policy attached to an OU applies to every account in it, including accounts in OUs nested inside it and accounts moved in later.
Keep workloads out of the management account: SCPs never apply to it, so no guardrail can protect what runs there.
Every account that Organizations creates gets a role called OrganizationAccountAccessRole, which the management account can assume. That's the first way in, with no new password.

More detail

The account that creates the organization becomes the management account. It pays for everything (consolidated billing), creates or invites member accounts, groups them into organizational units (OUs) and attaches SCPs. SCPs never apply to the management account itself, so keep workloads out of it.

Quiz yourself on AWS Organizations →

← All terms