Multi-account governance

Key points

• Management account: creates the organization, invites and removes accounts, attaches policies and pays every charge. Keep workloads out of it, because SCPs do not restrict it.
• OUs: group accounts by workload or environment. The hierarchy can be 5 levels deep below the root, and policies are inherited downward.
• Feature sets: all features (recommended, required for SCPs, RCPs and declarative policies) or consolidated billing only.
• Consolidated billing: one bill, combined usage for volume discounts, shared Reserved Instance discounts and Savings Plans, at no extra fee.
• Membership: an account belongs to only one organization at a time.

Key points

• SCP: limits IAM users and roles in member accounts, including the member root user. It does not affect the management account or service-linked roles.
• FullAWSAccess: attached by default. A deny list keeps it and adds Deny statements. Removing it without a replacement makes every action fail.
• Inheritance: an account has only what every parent above it allows, from the root down to the account.
• RCP: limits what anyone, including principals outside the organization, can do on resources of supported services such as S3, KMS, SQS, Secrets Manager, DynamoDB and STS.
• Data perimeter: an RCP keeps resources reachable only by identities of your organization, and an SCP limits services or Regions that your principals can use.

Key points

• Landing zone: a well-architected multi-account environment. Earlier versions create a Security OU with the Log Archive and Audit accounts, and landing zone 4.0 lets you define your own structure.
• Account Factory: a configurable template that provisions new accounts with pre-approved settings and controls.
• Preventive controls: implemented with SCPs and RCPs, they block actions before they happen.
• Detective controls: implemented with AWS Config rules, they flag noncompliant resources.
• Proactive controls: implemented with CloudFormation hooks, they stop noncompliant resources before provisioning.
• Guidance: controls are mandatory (always on), strongly recommended or elective.

Key points

• Shareable examples: VPC subnets, transit gateways, Route 53 Resolver rules, prefix lists, License Manager configurations, Network Firewall policies, Aurora DB clusters and Private CA.
• VPC sharing: the owner shares subnets with participants in the same organization. Participants create their own resources there but cannot see or change resources of others.
• Invitations: once sharing with Organizations is enabled, accounts in the organization need no invitation. Accounts outside it must accept one.
• Managed permissions: define what consuming accounts can do with the shared resource. Their own IAM policies and SCPs still apply.
• Cost: AWS RAM itself has no charge. The shared resource is billed as usual.

Key points

• Why: SCPs do not restrict the management account, so security tooling should run from a dedicated member account.
• Security services: GuardDuty, Security Hub CSPM, Macie, Inspector, Detective, Firewall Manager, IAM Access Analyzer and AWS Config support a delegated administrator.
• Trusted access: lets a service act across all accounts, for example an organization trail in CloudTrail or StackSets with service-managed permissions.
• Limits: only the management account creates or invites accounts. A delegated administrator cannot.
• Guardrails still apply: a delegated administrator is a member account, so SCPs and RCPs affect it.

Key points

• Tag policies: standardize tag keys, values and case. Enforcement blocks noncompliant tagging operations on chosen resource types, but untagged resources are not evaluated.
• Tag compliance: AWS Resource Groups reports noncompliant tags, and the management account sees every account.
• Backup policies: apply backup plans to resources across the accounts of the organization.
• Amazon EC2 policies: declare and enforce EC2 configurations at scale, kept in place even when the service adds new features or APIs.
• AI services opt-out policies: control data collection by AWS AI services for every account.