Section 1
Foundations: Complexity
Preview
Preview: Organizational Complexity
- 4 of 8 lesson topics
- 1 overview segment
- 3 core concepts
- 2 exam tips
Lesson Topics
- AWS Organizations
- AWS Control Tower
- Service Control Policies
- Account Invitations
Overview
Multi-account architecture is about separating workloads, teams, and risk while still applying consistent governance. Architects must balance isolation, delegated administration, shared services, auditability, and billing visibility across an organization.
Core Concepts
- **AWS Organizations:** A service for centrally managing multiple AWS accounts in an organization. Accounts can be grouped into OUs for governance and billing, and policies attached at the root, OU, or account level affect member accounts through inheritance.
- **Organizational Units (OUs):** Hierarchical containers for AWS accounts. OU design is an architectural decision because inherited policies can reduce blast radius, separate environments, and delegate administration boundaries.
- **Service Control Policies (SCPs):** Permission guardrails for member accounts. SCPs do not grant access; effective permissions still require identity policies, resource policies, permissions boundaries, session policies, and other applicable controls to allow the action.
Exam Tips
- Identify the governance scope first: single account, OU, entire organization, or selected services. The correct control usually follows that boundary.
- Do not treat consolidated billing as security governance. Pair billing centralization with SCPs, logging, account separation, and access controls when the scenario requires governance.