AWS Organizations Introduction – SAP-C02 Study Guide

Purpose of This Lesson

AWS Organizations provides a centralized way to create and manage multiple AWS accounts within a single organization. It is a foundational service for multi-account AWS architectures, enabling consolidated billing and governance controls across accounts.

This lesson introduces the core capabilities of AWS Organizations and Service Control Policies (SCPs), including how organizations can create additional AWS accounts for workload isolation, testing, and centralized management.

Key Concepts

AWS Organizations

AWS Organizations lets an organization group multiple AWS accounts under one management structure. Rather than treating every account as an entirely separate billing and governance boundary, the organization can apply centralized controls and administrative processes.

Key capabilities include:

• Managing multiple AWS accounts from a central organization.
• Creating additional AWS accounts within the organization.
• Using consolidated billing through a single organization-level bill.
• Applying governance controls across accounts.
• Defining Service Control Policies (SCPs) that limit which AWS API actions accounts can use.

Consolidated Billing

Consolidated billing combines usage from member accounts into a single bill for the organization. This provides centralized payment management and can support organization-wide cost visibility and billing administration.

Consolidated billing does not merge accounts into one account. Each account remains a separate security and operational boundary with its own resources, users, and permissions.

Service Control Policies

SCPs are organization-level governance policies that define the maximum permissions available to accounts or organizational units. They can allow or deny AWS API actions within member accounts, but they do not grant permissions by themselves.

For an action to succeed, it must be permitted by the applicable identity- or resource-based policies and must not be blocked by an SCP. An SCP therefore acts as a permissions boundary across accounts rather than as a replacement for IAM policies.

Creating Accounts with Organizations

AWS Organizations can be used to create additional member accounts. Separate accounts are useful for:

• Isolating production, development, and testing environments.
• Separating workloads or business units.
• Applying different governance requirements.
• Testing multi-account behavior without affecting a primary account.

Exam-Relevant Takeaways

• AWS Organizations is the service used to centrally manage multiple AWS accounts.
• Consolidated billing provides one organization-level bill while preserving account separation.
• Organizations can create new member accounts.
• SCPs control the maximum available permissions for accounts or organizational units.
• An SCP does not grant permissions; IAM permissions are still required.
• A deny in an applicable SCP prevents the action even if an IAM policy allows it.
• Multi-account designs support workload isolation and centralized governance.

Architecture Decision Guide

Requirement	AWS Organizations capability	Design implication
One billing relationship for multiple AWS accounts	Consolidated billing	Keep accounts separate while centralizing payment administration
Central governance across accounts	SCPs and organization structure	Apply guardrails consistently to member accounts
Environment isolation	Separate member accounts	Use account boundaries for production, development, testing, or other workloads
Additional isolated AWS environment	Account creation through Organizations	Create a new member account rather than mixing unrelated workloads in one account
Restrict specific AWS API actions across accounts	SCPs	Define the maximum permissions allowed; also configure IAM permissions

Common Exam Traps

• Assuming consolidated billing combines accounts: Accounts remain distinct even when billed together.
• Treating an SCP as an IAM permission policy: SCPs limit permissions but do not grant access to users or roles.
• Ignoring account boundaries: A member account is still a separate security and operational boundary.
• Assuming an IAM allow overrides an SCP deny: An applicable SCP deny takes precedence.
• Using one account for every environment by default: Separate accounts can provide stronger isolation and more targeted governance.

Real-World Engineer Notes

A multi-account strategy is often preferable to placing every workload in a single account. Account boundaries can reduce the blast radius of operational mistakes, simplify environment separation, and make governance easier to apply consistently.

When designing SCPs, treat them as preventive guardrails. They should restrict actions that must never be available in particular accounts or organizational scopes, while normal access management remains the responsibility of IAM policies and related controls.

Before applying restrictive SCPs broadly, test them against required deployment and operational workflows. An overly broad deny can block legitimate administration, automation, or account provisioning activities.

Quick Reference Summary

• AWS Organizations: Central management framework for multiple AWS accounts.
• Consolidated billing: One billing relationship for accounts in the organization.
• Member account: A separate AWS account managed within an organization.
• SCP: Organization-level policy that limits the maximum permissions available to accounts or organizational units.
• Account creation: Organizations can provision additional member accounts for isolation and testing.
• Critical distinction: SCPs restrict access; they do not grant access.

Flashcards

1. What is AWS Organizations?

AWS Organizations is an AWS service for centrally managing multiple AWS accounts.

2. What does consolidated billing provide?

It combines billing for accounts in an organization into a single organization-level bill.

3. Does consolidated billing merge AWS accounts?

No. Each account remains a separate security and operational boundary.

4. What are SCPs used for?

SCPs define which AWS API actions can be used within accounts or organizational units by setting a maximum permissions boundary.

5. Do SCPs grant permissions?

No. IAM policies must still grant the required permissions.

6. What happens if an SCP denies an action that an IAM policy allows?

The action is blocked because the SCP establishes an organization-level restriction.

7. Why create separate member accounts?

To isolate environments, workloads, or business units and apply governance independently.

8. Can AWS Organizations create new accounts?

Yes. Organizations can be used to create additional member accounts.

Practice Questions

Question 1

A company has five AWS accounts and wants centralized payment administration without moving all resources into one account. Which capability should the solutions architect use?

• A. IAM groups
• B. Consolidated billing through AWS Organizations
• C. An SCP attached to the management account
• D. Resource sharing across accounts

Correct answer: B. Consolidated billing through AWS Organizations provides a single billing relationship while keeping the AWS accounts separate.

Question 2

A security team wants to ensure that no principal in a member account can perform a specific AWS API action. Which control is most appropriate for this organization-wide restriction?

• A. An SCP that denies the action
• B. An IAM group with an allow policy
• C. A resource-based policy that allows the action
• D. A billing alert

Correct answer: A. An SCP deny can prevent the action throughout the applicable account or organizational scope. IAM policies alone do not provide the same organization-level guardrail.

Question 3

An administrator attaches an SCP that allows an API action to an account, but no IAM policy grants the user permission to perform that action. What is the result?

• A. The user can perform the action because the SCP allows it.
• B. The user can perform the action only from the management account.
• C. The user cannot perform the action because an SCP does not grant permissions.
• D. The action is automatically granted to the account root user only.

Correct answer: C. SCPs set the maximum permissions available but do not grant permissions. An identity- or resource-based policy must also allow the action.

Question 4

A company needs a separate AWS environment for testing multi-account behavior without affecting its existing workloads. Which approach directly supports this requirement?

• A. Create an additional member account through AWS Organizations.
• B. Create another IAM user in the existing account.
• C. Use a second VPC in the existing account only.
• D. Enable consolidated billing on the existing account.

Correct answer: A. Organizations can create additional member accounts, providing a separate account boundary for testing and isolation.