Lesson 03 — AWS Organizations Fundamentals

Learning Path

☁️ Phase 2 – AWS Cloud Security

📘 Module 03 – AWS Organizations & Multi-Account Security

🎯 Lesson Objective

By the end of this lesson, you will be able to:

Understand AWS Organizations.
Identify the components of an AWS Organization.
Explain the Management Account and Member Accounts.
Understand centralized governance.
Describe how AWS Organizations simplifies enterprise cloud management.

📚 Lesson Information

Estimated Time: 60 Minutes

Difficulty: Beginner

Prerequisites: Lesson 02 – Why Enterprises Use Multiple AWS Accounts

Hands-on Lab: No

Assignment: No

💼 Business Value

Managing dozens or hundreds of independent AWS accounts individually is inefficient and increases operational complexity.

AWS Organizations allows enterprises to centrally manage all AWS accounts under a single organization while maintaining security, governance and billing control.

It provides a single place to:

Create AWS Accounts
Organize accounts
Apply governance
Consolidate billing
Delegate administration
Scale cloud operations

🏢 In the Company

CloudNova Technologies has grown rapidly.

The company now operates:

Development
Testing
Production
Security
Networking
Shared Services

Each team owns one or more AWS accounts.

Managing these accounts independently has become difficult.

The Cloud Security Team decides to implement AWS Organizations to centrally govern every AWS account.

🌍 What is AWS Organizations?

AWS Organizations is a service that allows you to centrally manage multiple AWS accounts.

Instead of treating every account independently, AWS Organizations groups accounts into a single enterprise structure.

This enables:

Central governance
Central billing
Policy management
Account organization
Simplified administration

🏗 AWS Organization Structure

CloudNova AWS Organization

Management Account
│
├── Security Account
├── Log Archive Account
├── Shared Services Account
├── Development Account
├── Testing Account
├── Staging Account
├── Production Account
└── Sandbox Account

Every AWS account belongs to a single AWS Organization.

🔑 Core Components

AWS Organizations consists of several key components.

Component	Purpose
Management Account	Controls the AWS Organization
Member Accounts	Individual AWS accounts managed by the organization
Organizational Units (OUs)	Logical groups of AWS accounts
Service Control Policies (SCPs)	Governance guardrails applied to OUs and accounts
Consolidated Billing	Centralized billing for all accounts

These components work together to provide centralized management.

👑 Management Account

The Management Account (formerly called the Master Account) is the central account that owns the AWS Organization.

Responsibilities include:

Creating the organization
Inviting member accounts
Creating new AWS accounts
Managing billing
Applying governance
Managing Organizational Units
Applying Service Control Policies

Only one Management Account exists in each AWS Organization.

👥 Member Accounts

Member Accounts are individual AWS accounts that belong to the organization.

Examples include:

Development
Testing
Production
Security
Networking
Shared Services

Each account remains logically isolated while benefiting from centralized governance.

📦 Organizational Units (Preview)

As organizations grow, accounts are grouped into Organizational Units (OUs).

Example:

CloudNova

Management Account

│

├── Infrastructure OU
│   ├── Networking
│   ├── Shared Services
│   └── Security
│
├── Workloads OU
│   ├── Development
│   ├── Testing
│   ├── Production
│   └── Staging
│
└── Sandbox OU

Organizational Units make it easier to manage policies across related accounts.

We will explore OUs in detail in the next lesson.

💰 Consolidated Billing

AWS Organizations supports Consolidated Billing.

Instead of receiving separate invoices for every AWS account, the organization receives a single consolidated bill.

Benefits include:

Centralized payment
Cost allocation
Better visibility
Shared discounts
Reserved Instance optimization
Simplified financial reporting

Finance teams can still track spending by individual AWS account.

🔒 Security Benefits

AWS Organizations strengthens enterprise security by providing:

Central governance
Account isolation
Consistent policy enforcement
Central billing visibility
Simplified auditing
Better compliance management

It becomes the foundation for enterprise cloud governance.

🌎 Real Enterprise Example

CloudNova launches a new healthcare platform.

Instead of placing it inside an existing account, a dedicated AWS account is created.

The account automatically becomes part of the existing AWS Organization.

It immediately benefits from:

Central billing
Enterprise governance
Security controls
Organization-wide policies

No additional management infrastructure is required.

🚫 Common Mistakes

Avoid:

❌ Using one AWS account for every workload.

❌ Creating standalone AWS accounts outside the organization.

❌ Allowing departments to manage billing independently.

❌ Mixing production and development resources.

❌ Ignoring centralized governance.

✅ Enterprise Best Practices

Use AWS Organizations from the beginning.
Keep only governance functions in the Management Account.
Deploy workloads in Member Accounts.
Organize accounts by business function.
Review account structure regularly.
Apply governance consistently.
Limit direct use of the Management Account.

🧪 Enterprise Mission 01 — Explore AWS Organizations

Navigate to:

AWS Console

↓

AWS Organizations

Review:

Organization Name
Management Account
Member Accounts
Organization ID

Document your observations.

🧪 Enterprise Mission 02 — Identify CloudNova Accounts

List the AWS accounts required for CloudNova.

Include:

Management
Security
Log Archive
Shared Services
Development
Testing
Staging
Production
Sandbox

Explain the purpose of each account.

🧪 Enterprise Mission 03 — Design an Enterprise Organization

Create a simple AWS Organization for CloudNova.

Include:

Management Account
Infrastructure Accounts
Workload Accounts
Sandbox Accounts

Sketch the hierarchy.

🧪 Enterprise Mission 04 — Governance Discussion

Your CTO asks:

“Why shouldn’t we deploy applications directly into the Management Account?”

Prepare a short explanation covering:

Security
Operational risk
Governance
Best practice

🏢 Enterprise Scenario

CloudNova acquires a smaller company with six standalone AWS accounts.

The goal is to:

Bring those accounts under centralized governance.
Maintain account isolation.
Simplify billing.
Standardize security.

Explain how AWS Organizations supports this migration.

📊 Knowledge Check

What is AWS Organizations?
What is the purpose of the Management Account?
What are Member Accounts?
Why should workloads run in Member Accounts instead of the Management Account?
What is Consolidated Billing?
What are Organizational Units (OUs)?
Why is centralized governance important?
Can an AWS account belong to more than one AWS Organization?
Why should the Management Account be protected?
How does AWS Organizations support enterprise cloud security?

📋 Lesson Completion Checklist

Task	Status
Understood AWS Organizations	☐
Identified Management Account	☐
Identified Member Accounts	☐
Reviewed Consolidated Billing	☐
Designed CloudNova Organization	☐
Completed Enterprise Scenario	☐

💡 Key Takeaways

After completing this lesson, you should understand:

AWS Organizations provides centralized management for multiple AWS accounts.
Every AWS Organization has one Management Account and multiple Member Accounts.
Workloads should run in Member Accounts, while the Management Account focuses on governance.
Consolidated Billing simplifies financial management across the enterprise.
AWS Organizations forms the foundation for scalable, secure enterprise cloud environments.

🚀 Next Lesson

➡️ Lesson 04 — Organizational Units (OUs)