AWS Organizations Popular2016年〜
A service for centrally managing multiple AWS accounts
What It Does
AWS Organizations is a service for managing multiple AWS accounts as a single organization. It provides account creation, grouping (OUs), permission control through Service Control Policies (SCPs), and cost management through Consolidated Billing.
Use Cases
Used for implementing multi-account strategies (separating production, development, and staging), managing accounts by department, applying organization-wide security policies, and leveraging volume discounts through consolidated billing.
Everyday Analogy
Think of it like a holding company for a corporate group. The holding company (management account) oversees subsidiaries (member accounts), establishes group-wide rules (SCPs), and consolidates accounting (billing). Each subsidiary operates independently while following the group's governance.
What Is Organizations?
AWS Organizations is the foundational service for AWS multi-account management. AWS best practices recommend separating accounts by workload and environment. Organizations lets you manage these accounts hierarchically and apply unified governance. Organizations itself is free to use.
OUs and Service Control Policies
Organizational Units (OUs) are a mechanism for grouping accounts. For example, you might create 'Production OU,' 'Development OU,' and 'Security OU.' Service Control Policies (SCPs) define the maximum permissions applied to OUs or accounts. SCPs can prohibit the use of specific regions or restrict the use of certain services. To broaden your knowledge of OUs and Service Control Policies, specialized books (Amazon) can also be useful.
Getting Started
Click 'Create organization' in the Organizations console, and your current account becomes the management account. Add member accounts by creating new ones or inviting existing ones. Create OUs, place accounts in them, and apply SCPs to establish governance. Using Control Tower alongside it lets you automatically build a multi-account environment based on best practices.
Things to Watch Out For
- SCPs do not apply to the management account, so avoid running workloads in the management account
- SCPs define the maximum permissions. Final access permissions are determined by the combination of SCPs and IAM policies
- Organizations itself is free, but charges apply for the resources consolidated under consolidated billing
