1.2 AWS Organizations, SCPs, and Multi-Account Strategy

Quick Answer: AWS Organizations governs many accounts from one management account. Service Control Policies (SCPs) set the maximum permission ceiling for member accounts — they only restrict, never grant, and they never touch the management account. AWS Control Tower automates the whole landing zone. Use a multi-account design to isolate blast radius and simplify billing.

AWS Organizations

AWS Organizations is a free governance service that groups accounts into an organization rooted at a single management (payer) account. Accounts are arranged in Organizational Units (OUs) — a tree up to five levels deep below the root.

Root (Management Account)
├── Security OU
│   ├── Log Archive Account
│   └── Security Tooling Account
├── Production OU
│   ├── Prod-App-A   └── Prod-App-B
├── Development OU
│   └── Dev-Sandbox
└── Suspended OU (quarantine)

A recommended pattern keeps a dedicated Log Archive and Security Tooling account in a Security OU so audit logs are isolated from workload accounts.

Service Control Policies (SCPs)

SCPs define the maximum set of permissions for principals in member accounts. They are a ceiling, not a grant — an action still needs an IAM Allow to actually run.

SCP Rules to Memorize

SCPs come in two strategies: deny lists (allow everything, then explicitly deny — the default starting point) and allow lists (deny everything, then explicitly allow only approved services).

Region-Restriction SCP (classic question)

{
  "Version": "2012-10-17",
  "Statement": [{
    "Sid": "DenyNonApprovedRegions",
    "Effect": "Deny",
    "Action": "*",
    "Resource": "*",
    "Condition": { "StringNotEquals": {
      "aws:RequestedRegion": ["us-east-1", "us-west-2", "eu-west-1"]
    }}
  }]
}

On the Exam: "Prevent member accounts from launching resources outside approved Regions" or "block any instance type larger than t3.large" → an SCP on the relevant OU. AWS Config rules are detective (they flag drift after the fact); SCPs are preventive.

AWS Control Tower

AWS Control Tower sits on top of Organizations and automates a best-practice landing zone.

Use Organizations alone when you need only basic consolidated billing and a few SCPs; choose Control Tower when you want an automated, audited landing zone with account vending.

Multi-Account Strategy Benefits

Common trap: SCPs do not replace IAM. A new account with a restrictive SCP and no IAM policies still cannot do anything — both layers must allow.

SCP Inheritance and Evaluation

SCPs are inherited down the OU tree, and the effective permission set at any account is the intersection of every SCP from the root down to that account, then intersected with IAM. Picture an account three levels deep: if the root SCP allows services A, B, and C, the parent OU's SCP allows only A and B, and the account-level SCP allows only A, then the account can use only service A — and even then only where IAM also allows it. This is why an over-tight SCP high in the tree can silently break every account beneath it, a frequent troubleshooting scenario ("users suddenly lost access in all accounts after an SCP change at the root").

A second subtlety: SCPs filter principal permissions but never affect resource-based policy grants made by AWS service-linked roles, and they do not apply to the service-linked roles AWS uses on your behalf for some operations. They also never restrict the management account, which is the deliberate escape hatch that keeps you from locking yourself out of the entire organization.

Cross-Account Access Patterns

Multi-account designs need controlled cross-account access. The two exam-favored mechanisms are IAM roles assumed via sts:AssumeRole (a workload in account A assumes a role in account B) and AWS Resource Access Manager (RAM) for sharing actual resources such as subnets, Transit Gateways, and License Manager configurations. A shared-services account commonly hosts central networking and shares its VPC subnets to workload accounts through RAM, avoiding duplicate VPCs.

Tagging, Cost, and Governance Glue

A mature organization layers complementary services on top of the account structure:

Exam framing: When a prompt mixes "central governance," "consistent guardrails," and "automated new-account provisioning," the layered answer is Organizations (structure) + SCPs (guardrails) + Control Tower (automation) — not a single service doing everything.