AWS Organizations

In this lesson, we’ll learn what AWS Organizations is, what it’s components are, and how it works.

What is AWS Organizations?

AWS Organizations is an account management service that we can use to manage multiple accounts under one roof. It allows us to group multiple accounts and Organizational Units (OUs) under one root account and then centrally manage all of them using the root account.

This helps manage accounts more easily by consolidating billing and allowing us to use a savings plan across all accounts. We can also share common resources within these OUs.

AWS Organizations terminology

Here are some key terminologies, concepts related to AWS Organizations:

• Organizational Units (OUs): OUs are a way to group accounts together for administrative purposes. We can create OUs to organize our accounts hierarchically based on our organization's structure, such as by department, project, or environment (e.g., production, development).

• Service Control Policies (SCPs): SCPs are a key feature of AWS Organizations that enable us to set permissions at the organization level. They help enforce compliance and security policies by restricting access to certain AWS services or actions.

• Root account: The root account contains all other accounts within the organization.. When we create an organization, AWS automatically creates a root account for us. Any SCPs applied at the root account are effective in all OUs.

• Management account: The account that we use to create the organization is marked as the management account. This account is the payer account that is billed for all charges incurred by the accounts within the organization. It is used to create, invite, and remove other accounts from the organization. It can also be used to apply SCPs to root and other OUs.

Service Control Policies

SCPs act as guardrails to control what actions and services are allowed or denied across all accounts within the organization. The structure of SCPs is the same as the IAM policy. SCPs can be attached to OUs or individual AWS accounts within an AWS Organizations hierarchy.

• When an SCP is attached to an OU, it affects all AWS accounts within that OU and any child OUs. However, SCPs are not applied retroactively; they only affect future actions and resources created within the affected accounts and OUs.

• SCPs are applied hierarchically across an organization's OUs and accounts. When an SCP is attached to a parent OU, it automatically applies to all child OUs and accounts unless explicitly overridden. This inheritance model allows organizations to establish baseline security controls while granting flexibility for more specific controls at lower levels of the hierarchy.

• SCPs are evaluated during access control decisions made by AWS services. When a request is made to perform an action within an AWS account, AWS evaluates the applicable SCPs along with other identity-based policies to determine whether the action is allowed or denied. SCPs take precedence over identity-based policies, meaning that even if an identity has explicit permissions granted through IAM policies, those permissions can be further restricted by SCPs.

How AWS Organizations work?

AWS Organizations operates by establishing a hierarchy of accounts within an organization and applying policies and controls at various levels to govern the behavior and actions of those accounts. At the core of AWS Organizations is a service control plane that manages the enforcement of policies across the organization's accounts.

When an AWS account is created and added to an organization, it becomes a member account within that organization. The member account inherits the policies and controls defined at higher levels of the organizational hierarchy, such as organizational units (OUs) or the root of the organization.

AWS Organizations uses a distributed architecture to propagate policies and controls across accounts within the organization. Policies, such as service control policies (SCPs) and tagging policies, are stored centrally and distributed to member accounts as needed. This allows for centralized management and enforcement of policies while ensuring low-latency access to resources within individual accounts.

Example: Managing multiple accounts

Consider the scenario where the following accounts:

• Four accounts for developers

• Two account for testing

• An admin account

• A management account

These are multiple accounts with different set of actions. Managing them individually will be quite difficult. So to ease the management, we'll create an organization. A better structure for our organization would be as follows:

We'll create an organization using the management account. We'll create OUs for each of these domains with appropriate SCPs attached with them. After that we'll invite these accounts and add them within their appropriate OU. The hierarchy of our organization in this case will look as follows:

By adding these accounts under our organization, we'll now easily be able to streamline management, enforce standardized policies, and centralize billing and resource usage tracking for these accounts.

Best practices

Here are some best practices for using AWS Organizations effectively:

• Establish a clear organizational structure: Design a logical hierarchy of OUs and accounts that reflects our company's structure and business needs. This will help streamline management and enforce policies more effectively.

• Use SCPs properly: SCPs are powerful tools for controlling access to AWS services and resources. Use them to enforce security and compliance standards across our organization. However, be cautious not to overly restrict access, which could impede innovation and productivity.

• Implement least privilege: Follow the principle of least privilege when assigning permissions to accounts and users within our organization. Only grant access to the resources and services necessary for individuals to perform their roles effectively.

• Use tagging for resource AWS Organization: Implement a consistent tagging strategy across our AWS accounts to categorize and track resources effectively. Tags can be used to enforce policies, manage costs, and improve visibility into resource usage.

• Regularly review and refine policies: Continuously review and refine our SCPs, IAM policies, and tagging strategies to adapt to changing business requirements and evolving security best practices. Regular audits and assessments can help identify gaps and areas for improvement.

• Monitor and enforce compliance: Implement mechanisms to monitor compliance with organizational policies and standards. Leverage AWS Config, AWS Config Rules, and AWS Security Hub to automate compliance checks, detect violations, and remediate non-compliant resources.

By following these best practices, organizations can effectively leverage AWS Organizations to manage and govern their AWS environment securely, efficiently, and in alignment with business objectives.