Basic Information
| Field | Value |
|---|---|
| English | AWS Organizations |
| Full name | AWS Organizations |
| Chinese | 多账户集中管理 |
| Japanese | AWS Organizations（複数アカウントの一元管理） |
| Exam frequency | ⭐⭐⭐⭐⭐ |
| Often confused with | AWS Control Tower / AWS IAM |
One-line summary
Centrally manage AWS accounts, OUs, SCP permission boundaries, and consolidated billing.
Core capabilities and use cases
- Groups member accounts into organizational units (OUs) by business, environment, or security boundary.
- Service control policies (SCPs) define the maximum available permissions and inherit from the root, OU, or account.
- SCPs restrict permissions but never grant them; an IAM or resource policy must still allow the action.
- Consolidated billing lets the management account pay centrally while member accounts keep separate resources and identities.
- Eligible usage can aggregate for selected tiered pricing, Reserved Instance, or Savings Plans benefits.
- Accounts, OUs, and activated cost-allocation tags help attribute spend to teams, environments, and projects.
- Separate production, development, security, and log-archive accounts to create stronger boundaries.
Exam focus and common pitfalls
- Organizations: accounts, OUs, SCPs, and consolidated billing.
- Control Tower builds a governed landing zone on top of Organizations; IAM manages identities inside an account.
- An OU is a logical grouping, not an AWS account.
Key takeaway
Organizations manages accounts and permission boundaries; SCPs can restrict but cannot grant.