AWS Organizations
AWS Organizations is a service on Amazon Web Services that lets a company centrally manage and govern multiple AWS accounts as a single organization. Accounts are grouped into organizational units (OUs), and Service Control Policies (SCPs) are attached to those OUs as governance boundaries so that users in member accounts can only perform actions that meet the organization’s security requirements. Organizations also unifies billing across every member account through consolidated billing — paid centrally by the master (payer) account — and underpins account-sharing features used elsewhere, such as Amazon VPC sharing and AWS License Manager cross-account license visibility.
Key points
- Centrally manages and governs multiple AWS accounts grouped into a single organization, at no additional cost.
- Organizational Units (OUs) — groups of accounts that serve specified applications; accounts and OUs can be nested under a root/main account (e.g. Root account → Production Account and other accounts → further sub-accounts).
- Service Control Policies (SCPs) — attached to OUs as a permission ceiling: they set the maximum available permissions for the IAM users and roles in member accounts but never grant permissions themselves, so an action still needs an explicit IAM allow within the account to actually be permitted. SCPs never affect the management account itself.
- Resource control policies (RCPs) — a newer organization policy type that sets a permission ceiling on resources rather than on IAM principals: an RCP restricts what any principal (including ones outside the organization) can do to a resource in a member account, complementing SCPs, which restrict what principals inside the organization can do. Like SCPs, RCPs never grant permissions and never affect the management account. RCPs currently cover a defined set of services, including Amazon S3, DynamoDB, KMS, AWS Secrets Manager, and STS, among others — the two policy types together materially tighten organization-wide guardrails beyond what SCPs alone could enforce.
- Consolidated billing — combines the billing of previously distinct AWS accounts into one bill, tracks usage and charges across member accounts, and helps the organization reach volume discounts sooner.
- The master (payer) account — now called the management account — is responsible for paying the charges of all resources used by every account in the organization.
- Also used to share resources across accounts, e.g. Amazon VPC sharing (subnets shared with other accounts in the same organization) and cross-account license visibility via AWS License Manager.
Pricing
- Consolidated billing is provided at no additional cost; the master account pays the charges for all resources used across every account in the organization.