Organizations & Governance

Organizations & Governance Quick Notes

AWS Organizations

• Management account + OUs + member accounts.
• Benefits: consolidated billing, volume discounts, centralized policy.
• Move account A → B: Remove from old org → invite from new → accept from member (order matters).

Service Control Policies (SCPs)

• Fence around an account (including root).
• Do not grant permissions — only cap the maximum.
• Effective access needs identity Allow and SCP Allow.
• Do not affect service-linked roles.

Tag Policies

• Enforce allowed tag keys/values (e.g. dataClassification).
• Pair with SCPs that deny creates without required tags.

Control Tower

• Landing zone for multi-account isolation (dev/test/prod).
• Often paired with a shared networking account/VPC pattern.

CloudFormation StackSets

• Same template → many accounts and Regions.
• Fit: consistent EC2 types, Lambda roles, baseline Config rules everywhere.
• Plain stacks/templates in one account ≠ multi-account rollout. RAM shares resources; it does not “deploy this template everywhere.”

AWS Config

• Continuous configuration recording + compliance rules.
• History of configuration items in S3.
• Remediation via EventBridge → Lambda.

Spend Guardrails

• AWS Budgets: Thresholds / alerts per account; Compute Savings Plans coverage budgets.
• Cost Optimization Hub / Compute Optimizer: Idle or oversized EC2 recommendations.
• Trusted Advisor: Best-practice and service-limit checks (not a substitute for CloudTrail threat detection).

IAM Identity Center (SSO)

• Workforce access into many accounts.
• Federate to AWS Managed Microsoft AD (or connected directory).
• Prefer permission sets over creating IAM users for everyone.