Purpose of This Lesson

This lesson demonstrates how to create an AWS Organization, understand the resulting management account and root organizational unit, create an additional production account, and administer that account through the default cross-account IAM role. It also introduces the default service control policy (SCP) configuration and the distinction between organization administration and member-account administration.

Key Concepts

• AWS Organizations: The service used to centrally manage multiple AWS accounts.
• Management account: The account from which the organization is created. It is placed under the organization’s root and is used to manage organizational configuration.
• Root organizational unit (OU): The top-level container in the organization. The management account appears beneath the root.
• Member account: An additional AWS account created in or invited to the organization.
• Service control policy (SCP): A policy that defines the maximum permissions available to principals in organizational accounts. An SCP does not itself grant IAM permissions.
• Organization account access role: The default role created in an account created through AWS Organizations. The transcript identifies its default name as OrganizationAccountAccessRole and states that it receives full administrative permissions through the AdministratorAccess policy.
• Switch role: A console workflow that uses AssumeRole permissions to operate in another account through an IAM role.

Creating and Administering Accounts with AWS Organizations

1. Create the organization

From the AWS Organizations console, select Create organization. The account that performs this action becomes the organization’s management account. AWS creates the organization and its root OU immediately.

The organization initially contains the management account beneath the root. Additional accounts can then be created or existing accounts can be invited.

2. Review organization services and policies

The Organizations console includes an area for enabling supported AWS services for integration with Organizations. Several services may be disabled by default, so an integration must be enabled before it can be used through the organization.

Under Policies, the console exposes policy categories such as:

• AI services opt-out policies
• Backup policies
• Service control policies
• Tag policies

For this workflow, enable Service control policies before attempting to manage SCPs.

3. Understand the default SCP

After SCPs are enabled, AWS provides a managed FullAWSAccess policy by default. The lesson shows its effective statement as equivalent to:

{
  "Effect": "Allow",
  "Action": "*",
  "Resource": "*"
}

This allows all operations at the SCP layer. It does not replace IAM authorization; the account’s IAM users, groups, and roles still require permissions. The policy is shown as attached to the root and the account, and the lesson notes that it is linked to all OUs and accounts by default.

4. Create a member account

From AWS accounts, choose Add an AWS account. The console provides two paths:

• Create an account: Supply an account name and a unique email address for the account owner.
• Invite an existing account: Send an invitation to an existing AWS account owner.

When creating the account, the IAM role name can be specified. Leaving the default creates the OrganizationAccountAccessRole in the new account. The lesson describes this role as having the AdministratorAccess policy, allowing administrative management of the member account through role assumption.

An email address already used by another AWS account can cause account creation to fail. Use an address that is unique to the new account.

5. Switch into the production account

After the account is created, record its account ID and the role name. In the AWS console, choose Switch Role and provide:

• The production account ID
• OrganizationAccountAccessRole as the role name
• A display name such as production
• An optional identifying color, such as red for a production account

The switch-role process depends on the ability to assume the target role. Once assumed, the administrator can use the target account’s services with the permissions attached to that role.

The Organizations console itself may show permission errors after switching because the assumed role may not have permission to administer the Organizations console in the same way as the management account. Validate the role in a service such as IAM or EC2 instead.

In IAM, the role list should include OrganizationAccountAccessRole. Its attached AdministratorAccess policy confirms the administrative permissions described in the lesson.

Exam- or Assessment-Relevant Takeaways

• The account used to create an AWS Organization is the management account.
• Creating an organization produces a root OU containing the management account.
• AWS Organizations can either create a new account or invite an existing account.
• A newly created account requires a unique email address.
• The default cross-account administration role is OrganizationAccountAccessRole.
• The lesson associates this role with the AdministratorAccess policy.
• SCPs define the maximum permissions available in accounts; they do not grant permissions by themselves.
• The default FullAWSAccess SCP allows all actions at the SCP layer and is attached throughout the organization by default in the demonstrated setup.
• To administer a member account from the console, use Switch Role with the target account ID and role name.
• A permission error in the Organizations console after switching roles does not necessarily mean the role assumption failed. Test access in IAM or another service available to the assumed role.

Tool / Feature Decision Guide

Requirement	Appropriate choice	Reason
Start centrally managing multiple AWS accounts	Create an AWS Organization	The creating account becomes the management account.
Bring an already existing AWS account into the organization	Invite an existing account	The account owner receives an invitation rather than AWS creating a new account.
Add a new account under the organization	Create an account	AWS creates the account and the default organization access role.
Restrict the maximum permissions available to organizational accounts	Use an SCP	SCPs set permission boundaries at the organization, OU, or account level; IAM still controls actual grants.
Administer a created member account from the console	Switch Role into OrganizationAccountAccessRole	The role is created for organization-based administration and is associated with administrative access in the demonstrated workflow.
Verify that the assumed role works	Open IAM or EC2 in the target account	The Organizations console may not be available to the assumed role even when other administrative services are.

Common Traps / Misconceptions

• Confusing the management account with a member account: The account that creates the organization is the management account; it is not merely the first ordinary member account.
• Assuming an SCP grants access: An SCP can allow or deny the maximum permission set, but IAM permissions are still required.
• Using a non-unique email address: Account creation can fail if the email is already associated with an AWS account.
• Assuming the console is still creating an account forever: The console may appear to hang while the account is being created. Refreshing the page can reveal the completed state.
• Treating the default SCP as a security restriction: FullAWSAccess is permissive. A restrictive SCP must be created and attached separately; this lesson only previews that later workflow.
• Interpreting an Organizations error as failed role assumption: The assumed role may work in IAM or EC2 while lacking access to AWS Organizations.
• Forgetting the target account ID: Switching roles requires the account ID as well as the role name.
• Confusing role assumption with automatic account access: The administrator must have the ability to assume the role, and the role must exist in the target account.

Real-World Engineer / Analyst Notes

• Keep a controlled record of account IDs, account display names, and intended environments such as production. The lesson uses a course download file for this purpose.
• Use clear names and visual console color coding for environments to reduce the chance of making changes in the wrong account.
• Treat production role assumption as a high-impact operation, even when the role is intentionally administrative.
• After creating an account, verify both organization membership and target-account access rather than relying only on the creation status indicator.
• When troubleshooting, separate three questions: was the account created, was the role assumed, and does the current role have permission for the specific service being opened?
• Review enabled Organizations service integrations and policy types deliberately. The console may list capabilities that are disabled until explicitly enabled.

Quick Reference Summary

• Service: AWS Organizations
• Organization creator: Becomes the management account
• Initial structure: Root OU containing the management account
• New account workflow: AWS accounts → Add an AWS account → Create an account
• Existing account workflow: AWS accounts → Add an AWS account → Invite an existing account
• Required account detail highlighted in the lesson: Unique email address
• Default administration role: OrganizationAccountAccessRole
• Administrative policy shown: AdministratorAccess
• SCPs: Must be enabled before management; default FullAWSAccess allows Action: "*" on Resource: "*"
• Cross-account console workflow: Switch Role using account ID and role name
• Validation services: IAM or EC2 if Organizations reports a permission error
• Operational recovery: Refresh the Organizations page if account creation appears stuck

Flashcards

Q: An AWS account creates a new AWS Organization. What role does that account have afterward?

A: It becomes the organization’s management account and appears beneath the root OU.

Q: You need to bring an existing AWS account into an organization without creating a replacement account. Which Organizations option should you use?

A: Use Invite an existing account so the account owner can accept the organization invitation.

Q: What is the decisive reason to use OrganizationAccountAccessRole when administering a newly created member account?

A: AWS creates this role in the new account for organization-based administration. The lesson associates it with AdministratorAccess, enabling administrative access after the role is assumed.

Q: A new account creation fails immediately after an email address is entered. What should you check first?

A: Check whether the email address is already associated with an AWS account. The new account requires a unique email address.

Q: What must be enabled before service control policies can be managed in the demonstrated Organizations workflow?

A: Service control policies must be enabled under the organization’s policy settings.

Q: Compare an SCP with an IAM policy in this lesson’s context.

A: An SCP controls the maximum permissions available to accounts or OUs, while IAM policies grant permissions to principals. An SCP alone does not grant access.

Q: What does the default FullAWSAccess SCP shown in the lesson permit at the SCP layer?

A: It permits all actions on all resources, equivalent to Effect: Allow, Action: "*", and Resource: "*".

Q: You switched into the production account, but AWS Organizations displays API errors. What is the best next step?

A: Test the assumed role in IAM or EC2. The role may have the expected administrative access while lacking permission to use the Organizations console.

Q: Which two key values are required for the console Switch Role workflow demonstrated here?

A: The target account ID and the role name, which is OrganizationAccountAccessRole for the default created-account role.

Q: Why might refreshing the AWS Organizations console be necessary after account creation?

A: The page can appear to remain in a creating state even after the operation has completed. Refreshing can display the new account.

Q: In the demonstrated organization, where is the default full-access SCP attached?

A: The lesson shows it attached to the root and management account and notes that it is linked to all OUs and accounts by default.

Q: You want to create a restriction that limits what member accounts can do, rather than grant them permissions. Which feature is the relevant choice?

A: Use a service control policy. It establishes an organization-level permission boundary, while IAM remains responsible for grants.

Practice Questions

Question 1

A CloudOps engineer creates an AWS Organization from Account A and then checks the organization hierarchy. What should the engineer expect?

• A. Account A becomes a member account under a newly created management account
• B. Account A becomes the management account under the root OU
• C. Account A is automatically placed in a production OU
• D. Account A is converted into an IAM role

Correct answer: B. The account that creates the organization becomes the management account, which appears beneath the root OU. The lesson does not describe automatic placement into a production OU.

Question 2

An engineer is creating a new production account through AWS Organizations. The operation fails because the supplied email address is already used by another AWS account. What change addresses the demonstrated problem?

• A. Attach FullAWSAccess to the root
• B. Use a unique email address for the new account
• C. Switch into OrganizationAccountAccessRole
• D. Enable tag policies

Correct answer: B. The account creation workflow requires an email address that is not already associated with another AWS account.

Question 3

An engineer successfully switches into a member account using OrganizationAccountAccessRole, but the Organizations console returns permission errors. Which validation approach best matches the lesson?

• A. Delete and recreate the organization
• B. Remove the default SCP
• C. Open IAM or EC2 and verify access there
• D. Invite the same account again

Correct answer: C. The role may be valid and administrative while still lacking permission to use the Organizations console. IAM or EC2 can be used to validate the assumed role.

Question 4

A team wants to limit the maximum actions available to accounts in a production OU. Which feature should the team investigate?

• A. An SCP attached at the appropriate organizational level
• B. A display name in Switch Role
• C. The account’s unique email address
• D. The root account’s console color

Correct answer: A. SCPs define the maximum permissions available to principals in accounts or OUs. They must be combined with IAM permissions to produce usable access.

Question 5

A newly created member account contains OrganizationAccountAccessRole. The engineer wants to confirm why this role provides administrative access in the demonstrated workflow. What should the engineer inspect?

• A. The role’s attached AdministratorAccess policy
• B. The account’s display color
• C. The organization invitation email
• D. The root OU name only

Correct answer: A. The lesson shows the role with the AdministratorAccess policy attached, which accounts for its full administrative permissions in the target account.

WordPress Metadata

Suggested Slug:
aws-organizations-create-organization-add-account

Meta Description:
Study how AWS Organizations creates a management account, adds member accounts, applies service control policies, and enables role-based administration for SOA-C03 preparation.

Tags:
AWS Organizations, AWS IAM, Service Control Policies, Management Account, Organizational Units, AWS Accounts, Cross-Account Access, AdministratorAccess, AWS CloudOps, SOA-C03