AWS Organizations Architecture Patterns – SAP-C02 Study Guide

Purpose of This Lesson

AWS Organizations provides centralized management and governance for multiple AWS accounts. The key architecture decisions include how to create and migrate accounts, how to apply restrictions consistently, and how administrators access member accounts.

This lesson focuses on selecting the appropriate AWS Organizations capability for common multi-account scenarios.

Key Concepts

Programmatic account creation

AWS accounts can be created through the AWS Organizations API. This is the preferred approach when an organization must provision accounts repeatedly or at scale.

The AWS Management Console is appropriate for occasional, manual account creation. For larger numbers of accounts, API-based provisioning enables automation and integration with account vending workflows.

Important considerations include:

• Automating account naming and metadata assignment.
• Placing accounts into the correct organizational unit (OU).
• Applying governance controls consistently after account creation.
• Integrating account provisioning with infrastructure and identity workflows.

Service Control Policies for centralized restrictions

A Service Control Policy (SCP) defines the maximum available permissions for IAM principals in affected accounts. It does not grant permissions by itself. An action is allowed only when it is permitted by both the applicable identity/resource policies and the SCP boundary.

To prevent users in member accounts from modifying IAM, an organization can use an SCP that explicitly denies relevant IAM actions. An explicit deny overrides an allow from an IAM policy.

SCPs can be attached to:

• The organization root.
• An OU.
• Individual member accounts.

When the same restriction applies to several accounts, grouping those accounts in an OU and attaching one SCP to the OU reduces administrative effort and improves consistency.

The management account is a special case: SCPs do not restrict principals in the management account. Strong governance therefore requires protecting the management account separately and limiting its use for normal workloads.

Accessing a newly created member account

Creating an account through AWS Organizations does not mean the administrator is automatically operating inside that account. To launch resources, an authorized user should assume or switch to an IAM role in the member account.

A common pattern is:

1. Create the account in the organization.
2. Ensure a trusted cross-account administrative role exists in the new account.
3. Grant authorized administrators permission to assume that role.
4. Switch roles into the member account before creating resources.

This preserves account isolation while enabling centralized administration.

Moving an account between organizations

An AWS account can be moved from one organization to another using the AWS Organizations console for an individual migration or the Organizations API for repeatable or large-scale operations.

Account movement is a governance change, not merely an administrative task. Before migration, validate organization policies, billing ownership, delegated administration, trusted access, and the target organization’s account-placement strategy.

Inviting existing accounts

An organization can centralize governance for independently created AWS accounts by inviting those accounts to join as member accounts. This is useful when developers or business units already maintain separate accounts but need common policy controls, consolidated management, and centralized governance.

The account owner must accept the invitation. After joining, the account becomes subject to the organization’s applicable SCPs and organizational policies, subject to the normal Organizations rules and exceptions.

Exam-Relevant Takeaways

• Use the AWS Organizations API when account creation or account movement must be automated or performed at scale.
• Use the console for occasional manual account administration.
• Use SCPs to restrict what member-account principals can do; SCPs do not grant permissions.
• Attach a shared SCP to an OU when multiple accounts need the same restriction.
• Use cross-account role assumption or role switching to access a newly created member account.
• Invite existing standalone AWS accounts into an organization to establish centralized governance.
• Remember that SCPs do not apply to the organization’s management account.

Architecture Decision Guide

Requirement	Recommended approach	Reason
Create one or two accounts manually	AWS Organizations console	Simple and appropriate for occasional administration
Provision many accounts consistently	AWS Organizations API and automation	Enables repeatable account vending and reduced manual effort
Prevent member-account users from changing IAM	SCP with an explicit deny for required IAM actions	Centralizes preventive governance
Apply the same restriction to many accounts	Place accounts in an OU and attach the SCP to the OU	Minimizes policy duplication and administration
Access resources in a newly created member account	Switch or assume an authorized role in that account	Maintains account boundaries while enabling administration
Move one account to another organization	Organizations console	Suitable for a one-off migration
Move or manage many accounts programmatically	Organizations API	Supports automation and scale
Govern existing independent developer accounts	Create an organization and invite the accounts	Brings existing accounts under centralized governance

Common Exam Traps

• Treating an SCP as an IAM permission policy: An SCP sets the maximum permissions but never grants access. IAM policies are still required.
• Attaching separate SCPs to every account unnecessarily: If accounts share a control, place them in an OU and attach the policy there.
• Assuming account creation grants immediate access: Administrators still need to switch into the member account through an authorized role.
• Using the console for large-scale account provisioning: The console works for small numbers of accounts, while automation and the Organizations API are better for scale.
• Assuming SCPs protect the management account: SCPs do not restrict principals in the management account.
• Confusing an account invitation with automatic acceptance: The invited account must accept the invitation before joining the organization.
• Assuming an SCP deny can be overridden by an administrator: An explicit SCP deny cannot be overridden by an IAM allow in the affected account.

Real-World Engineer Notes

• Design OUs around governance requirements, such as production, nonproduction, security, or sandbox accounts, rather than mirroring the company’s reporting structure without considering policy needs.
• Use account-provisioning automation to standardize baseline configuration, logging, security contacts, and OU placement in addition to creating the account.
• Keep the management account dedicated to organization administration, billing, and governance. Avoid deploying ordinary application workloads there.
• Test restrictive SCPs in a controlled OU before applying them broadly. An overly broad deny can block legitimate operational actions.
• Treat account migrations as dependency changes. Review cross-account roles, centralized logging, security tooling, billing, and delegated administrator relationships before and after the move.

Quick Reference Summary

• Scale account creation: Organizations API.
• Manual account creation: Organizations console.
• Centralized preventive restriction: SCP.
• Shared restriction: SCP attached to an OU.
• Member-account administration: Assume or switch to a role in the member account.
• Existing standalone accounts: Invite them to the organization.
• Large-scale account movement: Organizations API.
• SCP limitation: SCPs restrict member accounts but do not grant permissions or govern the management account.

Flashcards

1. Q: What should be used to create many AWS accounts programmatically?

A: The AWS Organizations API, usually integrated with account-provisioning automation.

1. Q: When is the AWS Organizations console suitable for account creation?

A: For occasional manual creation, such as one or two accounts.

1. Q: What is the purpose of an SCP?

A: To define the maximum permissions available to principals in affected member accounts.

1. Q: Do SCPs grant permissions?

A: No. IAM and resource policies must still allow the action.

1. Q: How can an organization prevent member-account users from changing IAM?

A: Attach an SCP containing explicit denies for the applicable IAM actions.

1. Q: Where should a common SCP be attached when several accounts need the same restriction?

A: To an OU containing those accounts.

1. Q: How does an administrator access a newly created member account?

A: By switching to or assuming an authorized role in that member account.

1. Q: How can an existing standalone account join an organization?

A: The organization sends an invitation, which the account owner accepts.

1. Q: Which interface is appropriate for moving one account between organizations?

A: The AWS Organizations console.

1. Q: Which interface is better for moving many accounts between organizations?

A: The AWS Organizations API.

1. Q: Do SCPs apply to the management account?

A: No. SCPs do not restrict principals in the management account.

Practice Questions

Question 1

A company has 40 member accounts. Security requires that users in all sandbox accounts be prevented from disabling selected security services. The security team wants the lowest administrative overhead. What should the solutions architect recommend?

A. Attach an identical SCP directly to each account.
B. Place the sandbox accounts in an OU and attach one SCP to that OU.
C. Create an IAM policy in the management account and attach it to all users.
D. Use a resource-based policy in each sandbox account.

Correct answer: B

Explanation: An SCP attached to an OU applies to its member accounts and avoids duplicating the same policy at the account level. IAM policies in the management account do not directly control permissions in member accounts.

Question 2

A company has an automated workflow that must create and configure a new AWS account every week. Which approach best meets this requirement?

A. Create each account manually through the AWS Organizations console.
B. Use AWS Organizations API operations in the provisioning workflow.
C. Create IAM users in the management account for each new account.
D. Ask the account owner to create a standalone account and email the credentials.

Correct answer: B

Explanation: The Organizations API supports repeatable programmatic account creation and can be integrated with account vending and baseline configuration workflows.

Question 3

An administrator creates a member account through AWS Organizations and must deploy resources into it. What should the administrator do next?

A. Use the management account’s IAM permissions directly in the member account.
B. Switch to or assume an authorized role in the member account.
C. Attach an SCP granting administrator permissions to the new account.
D. Use the root credentials of the new account.

Correct answer: B

Explanation: Member-account resources should be managed through an authorized cross-account role. SCPs do not grant permissions, and using root credentials is not an appropriate administration pattern.

Question 4

Several developer teams already have separate AWS accounts. The security team wants to apply centralized organizational governance without recreating the accounts. What should the company do?

A. Invite the existing accounts to join a new AWS Organization.
B. Create IAM users with identical names in every account.
C. Move all workloads into one shared account.
D. Apply an SCP to the developer accounts before they join an organization.

Correct answer: A

Explanation: Existing standalone accounts can be invited to an organization. After the invitations are accepted, organizational governance such as applicable SCPs can be centralized.

Question 5

A company wants to deny IAM policy changes in member accounts using an SCP. An administrator in the management account must remain able to perform organization administration. Which statement is correct?

A. The SCP deny will restrict all principals, including those in the management account.
B. The SCP grants the security team permission to manage IAM.
C. The SCP can restrict affected member accounts, but SCPs do not apply to the management account.
D. The SCP applies only to users and not to roles.

Correct answer: C

Explanation: SCPs establish permission boundaries for affected member accounts and apply to principals such as users and roles. They do not restrict principals in the management account, which requires separate protection.