AWS Organizations

• AWS Organizations is an account management service that enables consolidating multiple AWS accounts into an organization that can be created and centrally managed.
• AWS Organizations include consolidated billing and account management capabilities that enable one to better meet the budgetary, security, and compliance needs of the business.
• As an administrator of an organization, new accounts can be created in an organization, and existing accounts invited to join the organization.
• AWS Organizations enables you to
  • Automate AWS account creation and management, and provision resources with AWS CloudFormation Stacksets.
  • Maintain a secure environment with policies and management of AWS security services
  • Govern access to AWS services, resources, and regions
  • Centrally manage policies across multiple AWS accounts
  • Audit the environment for compliance
  • View and manage costs with consolidated billing
  • Configure AWS services across multiple accounts

AWS Organization Features

• Centralized management of all of the AWS accounts
  • Combine existing accounts into or create new ones within an organization that enables them to be managed centrally
  • Policies can be attached to accounts that affect some or all of the accounts
• Consolidated billing for all member accounts
  • Consolidated billing is a feature of AWS Organizations.
  • Management account of the organization can be used to consolidate and pay for all member accounts.
• Hierarchical grouping of accounts to meet budgetary, security, or compliance needs
  • Accounts can be grouped into organizational units (OUs) and each OU can be attached to different access policies.
  • OUs can also be nested to a depth of five levels, providing flexibility in how you structure your account groups.
• Control over AWS services and API actions that each account can access
  • As an administrator of the management account of an organization, access to users and roles in each member account can be restricted to which AWS services and individual API actions
• Organization permissions overrule account permissions.
  • This restriction even overrides the administrators of member accounts in the organization.
  • When AWS Organizations blocks access to a service or API action for a member account, a user or role in that account can’t access any prohibited service or API action, even if an administrator of a member account explicitly grants such permissions in an IAM policy.
• Integration and support for AWS IAM
  • IAM provides granular control over users and roles in individual accounts.
  • Organizations expand that control to the account level by giving control over what users and roles in an account or a group of accounts can do.
  • Users can access only what is allowed by both the Organization policies and IAM policies.
  • Resulting permissions are the logical intersection of what is allowed by AWS Organizations at the account level, and what permissions are explicitly granted by IAM at the user or role level within that account.
  • If either blocks an operation, the user can’t access that operation.
• Integration with other AWS services
  • Select AWS services can be enabled to access accounts in the organization and perform actions on the resources in the accounts.
  • When another service is configured and authorized to access the organization, AWS Organizations creates an IAM service-linked role for that service in each member account.
  • Service-linked role has predefined IAM permissions that allow the other AWS service to perform specific tasks in the organization and its accounts.
  • All accounts in an organization automatically have a service-linked role created, which enables the AWS Organizations service to create the service-linked roles required by AWS services for which you enable trusted access
  • These additional service-linked roles come with policies that enable the specified service to perform only those required tasks
• Delegated Administrator
  • A member account can be designated as a delegated administrator for an AWS service integrated with Organizations.
  • Delegated administrator accounts can manage organization-level tasks for the specified service without requiring the management account.
  • Reduces reliance on the management account for day-to-day governance tasks.
  • When a delegated administrator is registered, it receives authorization to access all read-only Organizations API operations.
• Trusted Access
  • Trusted access grants permissions to a specified AWS service to perform tasks in the organization and its accounts.
  • Enables AWS services like CloudTrail, Config, GuardDuty, Security Hub, and many others to operate across all accounts in the organization.
  • Creates the necessary service-linked roles automatically in member accounts.
• Direct Account Transfers (2025)
  • AWS Organizations now provides the ability to directly transfer an account to a different organization without first having to remove the account from the current organization.
  • Eliminates the need for the account to go through a standalone phase during the transfer.
  • Reduces operational risk and simplifies multi-organization account migration workflows.
• Centralized Root Access Management (2024)
  • Enables centralized management of root user credentials across member accounts in Organizations.
  • Can centrally remove root user credentials (passwords, access keys, signing certificates, MFA) for member accounts.
  • Perform tightly scoped privileged root tasks using short-lived root sessions without requiring root credentials.
  • Helps prevent unintended root access and improves account security at scale.
  • Member accounts can regain access to accidentally locked Amazon S3 buckets using privileged root sessions.
• Data replication that is eventually consistent
  • AWS Organizations is eventually consistent.
  • AWS Organizations achieve high availability by replicating data across multiple servers in AWS data centers within its region.
  • If a request to change some data is successful, the change is committed and safely stored.
  • However, the change must then be replicated across multiple servers.

AWS Organizations Terminology and Concepts

Organization

• An entity created to consolidate AWS accounts that can be administered as a single unit.
• An organization has one management account along with zero or more member accounts.
• An organization has the functionality that is determined by the feature set that you enable i.e. All features or Consolidated Billing only

Root

• Parent container for all the accounts for the organization.
• Policy applied to the root is applied to all the organizational units (OUs) and accounts in the organization.
• There can be only one root currently and AWS Organization automatically creates it when an organization is created

Organizational Unit (OU)

• A container for accounts within a root.
• An OU also can contain other OUs, enabling hierarchy creation that resembles an upside-down tree, with a root at the top and branches of OUs that reach down, ending in accounts that are the leaves of the tree.
• A policy attached to one of the nodes in the hierarchy flows down and affects all branches (OUs) and leaves (accounts) beneath it.
• An OU can have exactly one parent, and currently, each account can be a member of exactly one OU.

Account

• A standard AWS account that contains AWS resources.
• Each account can be directly in the root or placed in one of the OUs in the hierarchy.
• Policy can be attached to an account to apply controls to only that one account.
• Accounts can be organized in a hierarchical, tree-like structure with a root at the top and organizational units nested under the root.
• Management account (formerly Master account)
  • Primary account which creates the organization
  • can create new accounts in the organization, invite existing accounts, remove accounts, manage invitations, and apply policies to entities within the organization.
  • has the responsibilities of a payer account and is responsible for paying all charges that are accrued by the member accounts.
  • is not affected by any SCPs or RCPs that are attached to the organization.
  • can centrally manage root email addresses of member accounts.
• Member account
  • Rest of the accounts within the organization are member accounts.
  • An account can be a member of only one organization at a time.
  • Can be directly transferred to a different organization without going through a standalone phase (2025 feature).

Invitation

• Process of asking another account to join an organization.
• An invitation can be issued only by the organization’s management account and is extended to either the account ID or the email address that is associated with the invited account.
• Invited account becomes a member account in the organization after it accepts the invitation.
• Invitations can be sent to existing member accounts as well, to approve the change from supporting only consolidated billing features to supporting all features.
• Invitations work by accounts exchanging handshakes.

Handshake

• A multi-step process of exchanging information between two parties.
• Primary use in AWS Organizations is to serve as the underlying implementation for invitations.
• Handshake messages are passed between and responded to by the handshake initiator (management account) and the recipient (member account) in such a way that it ensures that both parties always know what the current status is.

Available Feature Sets

Consolidated billing

• provides shared or consolidated billing functionality which includes pricing benefits for aggregated usage.

All Features

• includes all the functionality of consolidated billing and advanced features that give more control over accounts in the organization.
• allows the management account to have full control over what member accounts can do.
• invited accounts must approve enabling all features
• The Management account can apply SCPs and RCPs to restrict the services and actions that users (including the root user) and roles in an account can access, and it can prevent member accounts from leaving the organization
• Member accounts can’t switch from All features to Consolidated Billing only mode.

Organization Policy Types

AWS Organizations offers policy types in two broad categories: Authorization policies and Management policies.

Authorization Policies

Authorization policies help centrally manage the security of AWS accounts across an organization.

Service Control Policies (SCPs)

• Service Control Policies specify the services and actions that users and roles can use in the accounts that the SCP affects.
• SCPs are similar to IAM permission policies except that they don’t grant any permissions.
• SCPs are filters that allow only the specified services and actions to be used in affected accounts.
• SCPs override the IAM permission policy. So even if a user is granted full administrator permissions with an IAM permission policy, any access that is not explicitly allowed or that is explicitly denied by the SCPs affecting that account is blocked. for e.g., if you assign an SCP that allows only database service access to your “database” account, then any user, group, or role in that account is denied access to any other service’s operations.
• SCP can be attached to
  • A root, which affects all accounts in the organization
  • An OU, which affects all accounts in that OU and all accounts in any OUs in that OU subtree
  • An individual account
• Organization’s Management account is not affected by any SCPs that are attached either to it or to any root or OU the management account might be in.
• Updated SCP Quotas (May 2026): Maximum SCPs per node increased from 5 to 10, and maximum SCP size increased from 5,120 to 10,240 characters.

Resource Control Policies (RCPs) – Launched November 2024

• Resource Control Policies (RCPs) are a type of authorization policy that centrally restricts access to AWS resources in the organization.
• RCPs help establish a data perimeter in the AWS environment and restrict external access to resources at scale.
• RCPs complement SCPs but work independently — SCPs restrict what principals can do, while RCPs restrict what access resources can grant.
• RCPs are evaluated when resources are being accessed, irrespective of who is making the API request.
• Neither SCPs nor RCPs grant any permissions; they only set the maximum permissions available.
• RCPs do not affect resources in the management account — they only affect resources in member accounts.
• Supported services at launch: Amazon S3, AWS STS, AWS KMS, Amazon SQS, and AWS Secrets Manager.
• An AWS-managed policy called RCPFullAWSAccess is automatically attached to every entity when RCPs are enabled.
• RCP can be attached to the root, an OU, or a specific AWS account.
• Each RCP can contain up to 5,120 characters, up to 5 RCPs per node, and up to 1,000 RCPs per organization.
• No additional charges for enabling and using RCPs.

Management Policies

Management policies help centrally configure and manage AWS services and their features across an organization.

Declarative Policies – Launched December 2024

• Declarative policies help centrally declare and enforce desired configuration for a given AWS service at scale across an organization.
• Once attached, the configuration is always maintained even when the service adds new features or APIs — no policy updates needed.
• Prevents non-compliant actions regardless of whether they were invoked using an IAM role or by an AWS service using a service-linked role.
• Supported services: Amazon EC2, Amazon VPC, and Amazon EBS.
• Available attributes include: enforcing IMDSv2, serial console access, allowed AMI settings, image block public access, snapshot block public access, and VPC block public access.
• Provides account status reports to assess readiness before attaching a policy.
• Supports custom error messages to help end users understand why their action was blocked and how to remediate.
• Policies can be applied at the organization, OU, or account level.
• New accounts automatically inherit the declarative policy when they join the organization or OU.

Backup Policies

• Allow you to centrally manage and apply backup plans to the AWS resources across an organization’s accounts.
• Ensures consistent backup strategies across all member accounts.

Tag Policies

• Allow you to standardize the tags attached to the AWS resources in an organization’s accounts.
• Helps maintain consistent tag naming and values for cost allocation and resource management.

AI Services Opt-out Policies

• Allow you to control data collection for AWS AI services for all the accounts in an organization.
• Can opt out of data being used to improve AI/ML services across the organization.

Chatbot Policies

• Allow centralized configuration and management of AWS Chatbot settings across the organization.

Whitelisting vs. Blacklisting (SCPs)

• Whitelisting and blacklisting are complementary techniques used to apply SCPs to filter the permissions available to accounts.
• Whitelisting (Allow List)
  • Explicitly specify the access that is allowed.
  • All other access is implicitly blocked or denied.
  • By default, all permissions are whitelisted.
  • AWS Organizations attaches an AWS-managed policy called FullAWSAccess to all roots, OUs, and accounts, which ensures the building of the organizations.
  • For restricting permissions, replace the FullAWSAccess policy with one that allows only the more limited, desired set of permissions.
  • Users and roles in the affected accounts can then exercise only that level of access, even if their IAM policies allow all actions.
  • If you replace the default policy on the root, all accounts in the organization are affected by the restrictions.
  • You can’t add them back at a lower level in the hierarchy because an SCP never grants permissions; it only filters them.
• Blacklisting (Deny List)
  • The default behavior of AWS Organizations.
  • Explicitly specify the access that is not allowed.
  • Explicit deny of a service action overrides any allow of that action.
  • All other permissions are allowed unless explicitly blocked
  • By default, AWS Organizations attach an AWS-managed policy called FullAWSAccess to all roots, OUs, and accounts. This allows any account to access any service or operation with no AWS Organizations–imposed restrictions.
  • With blacklisting, additional policies are attached that explicitly deny access to the unwanted services and actions

Organizations Security and Monitoring

• CloudTrail Integration
  • AWS Organizations logs all API calls as events in CloudTrail.
  • Supports account membership events (2026): AccountJoinedOrganization and AccountDepartedOrganization events provide visibility into organizational membership changes.
  • Helps detect unauthorized activities and potential security incidents.
• MFA Enforcement for Root Users
  • AWS now requires MFA for root users across all account types (management, member, standalone).
  • MFA was first required for management account root users (May 2024), then standalone accounts (June 2024), and enforced for all (June 2025).

AWS Certification Exam Practice Questions

• Questions are collected from Internet and the answers are marked as per my knowledge and understanding (which might differ with yours).
• AWS services are updated everyday and both the answers and questions might be outdated soon, so research accordingly.
• AWS exam questions are not updated to keep up the pace with AWS updates, so even if the underlying feature has changed the question might not be updated
• Open to further feedback, discussion and correction.

1. An organization that is currently using consolidated billing has recently acquired another company that already has a number of AWS accounts. How could an Administrator ensure that all AWS accounts, from both the existing company and the acquired company, are billed to a single account?
   1. Merge the two companies, AWS accounts by going to the AWS console and selecting the “Merge accounts” option.
   2. Invite the acquired company’s AWS account to join the existing company’s organization using AWS Organizations.
   3. Migrate all AWS resources from the acquired company’s AWS account to the master payer account of the existing company.
   4. Create a new AWS account and set it up as the master payer. Move the AWS resources from both the existing and acquired companies’ AWS accounts to the new account.
2. Which of the following are the benefits of AWS Organizations? Choose the 2 correct answers:
   1. Centrally manage access polices across multiple AWS accounts.
   2. Automate AWS account creation and management.
   3. Analyze cost across all multiple AWS accounts.
   4. Provide technical help (by AWS) for issues in your AWS account.
3. A company has several departments with separate AWS accounts. Which feature would allow the company to enable consolidate billing?
   1. AWS Inspector
   2. AWS Shield
   3. AWS Organizations
   4. AWS Lightsail
4. A security team wants to prevent any external AWS account from accessing S3 buckets within their organization. Which Organizations policy type should they use?
   1. Service Control Policies (SCPs)
   2. Resource Control Policies (RCPs)
   3. Tag Policies
   4. Backup Policies
5. A company wants to enforce that all EC2 instances across their organization use IMDSv2, and ensure this remains enforced even when new APIs are introduced. Which AWS Organizations feature should they use?
   1. Service Control Policies (SCPs)
   2. Resource Control Policies (RCPs)
   3. Declarative Policies
   4. AI Services Opt-out Policies
6. Which statement correctly describes the difference between SCPs and RCPs in AWS Organizations?
   1. SCPs grant permissions while RCPs deny permissions.
   2. SCPs restrict what principals can do, while RCPs restrict what access resources can grant.
   3. RCPs affect the management account while SCPs do not.
   4. SCPs and RCPs are the same policy type with different names.
7. A company wants to centrally remove root user credentials from all member accounts in their organization. Which feature enables this?
   1. Service Control Policies (SCPs)
   2. AWS IAM Access Analyzer
   3. Centralized Root Access Management in AWS Organizations
   4. AWS Config Rules
8. Which of the following are management policy types in AWS Organizations? (Choose 3)
   1. Backup Policies
   2. Service Control Policies
   3. Tag Policies
   4. Resource Control Policies
   5. Declarative Policies

References

• AWS Organizations User Guide
• Resource Control Policies (RCPs)
• Declarative Policies
• Introducing RCPs – AWS Blog
• Simplify Governance with Declarative Policies – AWS Blog
• Secure Root User Access for Member Accounts