Management and Governance
CoreAWS Organizations
Central account hierarchy, organizational units, consolidated billing, resource sharing integrations, and service control policies.
Key points
- Use separate accounts as strong ownership and security boundaries, then group them into OUs by governance need.
- SCPs define maximum permissions for member accounts but do not grant access.
- Consolidated cost visibility supports allocation and commitments while each workload retains its own architecture.
Best-known use cases
- Apply organization-wide guardrails.
- Manage many accounts and consolidated billing centrally.
What candidates often confuse it with
- Organizations supplies hierarchy/SCPs; Control Tower provides a governed landing-zone experience.
- Organizations guardrails cap permissions; IAM policies and roles grant access.
Key takeaway
Choose Organizations for account hierarchy and SCP guardrails; never treat an SCP as a permission grant.
Related services
- AWS Control Tower
- AWS IAM Identity Center
- AWS Resource Access Manager (AWS RAM)
Relevant exam tasks
- D1.1
- D4.1
- D4.2
- D4.3
- D4.4