76. AWS Organizations

Overview

• AWS Organizations is an account management service that enables you to consolidate multiple AWS accounts into an organization that you create and centrally manage.
• AWS Organizations includes account management and consolidated billing capabilities that enable you to better meet the budgetary, security, and compliance needs of your business
• AWS Organizations is offered at no additional charge. You are charged only for AWS resources that users and roles in your member accounts use. 

AWS Organizations terminology and concepts

• Organization
  • An entity that you create to consolidate your AWS accounts so that you can administer them as a single unit.
  • An organization has one management account along with zero or more member accounts.
  • You can organize the accounts in a hierarchical, tree-like structure with a root at the top and organizational units nested under the root.
  • Each account can be directly in the root, or placed in one of the OUs in the hierarchy.
• Root
  • The parent container for all the accounts for your organization.
  • If you apply a policy to the root, it applies to all organizational units (OUs) and accounts in the organization.
• Organizational unit (OU)
  • A container for accounts within a root
  • When you attach a policy to one of the nodes in the hierarchy, it flows down and affects all the branches (OUs) and leaves (accounts) beneath it.
  • An OU can have exactly one parent, and currently each account can be a member of exactly one OU.
  • Each OU can contain multiple accounts, and you can move accounts from one OU to another.
  • OUs can be nested up to five levels deep.
  • You can use organizational units (OUs) to group accounts together to administer as a single unit. This greatly simplifies the management of your accounts
• Account
  • An account in Organizations is a standard AWS account that contains your AWS resources and the identities that can access those resources.
  • There are two types of accounts in an organization: a single account that is designated as the management account, and one or more member accounts.
• Service control policy (SCP)
  • A policy that specifies the services and actions that users and roles can use in the accounts that the SCP affects.
  • SCPs are similar to IAM permissions policies except that they don't grant any permissions.
  • Instead, SCPs specify the maximum permissions for an organization, organizational unit (OU), or account.
  • When you attach an SCP to your organization root or an OU, the SCP limits permissions for entities in member accounts.
• Backup policy
  • A type of policy that helps you standardize and implement a backup strategy for the resources across all of the accounts in your organization.

Best practices for the management account

• Use the management account only for tasks that require the management account
• Use a group email address for the management account's root user
• Use a complex password for the management account's root user
• Enable MFA for your root user credentials
• Add a phone number to the account contact information
• Review and keep track of who has access
• Document the processes for using the root user credentials
• Apply controls to monitor access to the root user credentials

Best practices for member accounts

• Use a group email address for all member account root users
• Use a complex password for member account root user
• Enable MFA for your root user credentials
• Add the management account's phone number to the member account contact information
• Review and keep track of who has access
• Document the processes for using the root user credentials
• Use an SCP to restrict what the root user in your member accounts can do
• Apply controls to monitor access to the root user credentials

AWS Account Management

• AWS Account Management extends AWS Organizations to also include the management of the metadata attached to an AWS account, such as the alternate contact information.
• When you enable trusted access for Account Management, the Account Management service grants Organizations and its management account permissions to access the metadata for all of the organization's member accounts.
• After you enable trusted access, you can also choose to designate one of your member accounts as a delegated admin account for AWS Account Management. 

Reference

What is AWS Organizations? - AWS Organizations

Welcome to the AWS Account Management Reference Guide - AWS Account Management