AWS Organizations

What it is
- Centrally manage and govern multiple AWS accounts as a single organization.
- Free service.
Structure
- Management (payer) account at the root, plus member accounts.
- Organizational Units (OUs) group accounts (Prod, Dev, Sandbox) so policies apply by group.
What you get
- consolidated billing — one bill, and pooled usage so volume discounts, Reserved Instances, and Savings Plans apply across all accounts.
- Service Control Policies (SCPs) — guardrails that set the maximum permissions any principal in an account can have. An SCP never grants permission; it only limits. It applies even to the account root user.
- Central integration point for AWS CloudTrail organization trails, AWS Config, AWS Security Hub, and AWS Resource Access Manager (RAM).
Why multi-account at all
- Hard blast-radius isolation, per-team cost separation, separate compliance boundaries, and per-account service quotas.
Not to be confused with
- AWS Control Tower — sets up a whole governed multi-account landing zone using Organizations, with best practices pre-applied.

Linked from