Runbook 01 Build a Secure Multi-Account

Module: 03 – AWS Organizations & Multi-Account Security

Enterprise Lab: 01

Estimated Time: 2–3 Hours

Difficulty: ⭐⭐⭐⭐☆

Estimated Cost: AWS Free Tier (Some services may incur minimal charges. Always monitor AWS Cost Explorer.)

🎯 Objective

As a Cloud Security Engineer at CloudNova Technologies, you have been tasked with designing and implementing a secure multi-account AWS environment.

By completing this runbook, you will learn how to:

Create an AWS Organization
Design Organizational Units (OUs)
Create Member Accounts
Configure consolidated billing
Apply Service Control Policies (SCPs)
Enable centralized security services
Configure centralized logging
Understand enterprise governance
Validate a secure multi-account architecture

🏢 Business Scenario

CloudNova Technologies has experienced significant growth and currently operates multiple business units.

To improve security, governance, compliance, and cost management, the company has decided to migrate from a single AWS account to a multi-account architecture using AWS Organizations.

As the Cloud Security Engineer, you are responsible for designing and implementing the organization’s AWS landing zone.

📋 Prerequisites

Complete:

Module 01 – AWS Security Foundations
Module 02 – Identity & Access Management (IAM)

Required:

AWS Management Account
Administrator Access
AWS CLI Installed
Visual Studio Code
MFA Enabled

🏗 Target Enterprise Architecture

CloudNova Technologies

AWS Organization
│
├── Management Account
│
├── Production OU
│      ├── Production Account
│      └── Shared Services
│
├── Development OU
│      ├── Development Account
│      └── Testing Account
│
├── Security OU
│      ├── Security Account
│      ├── Logging Account
│      └── Audit Account
│
└── Sandbox OU
       └── Sandbox Account

Step 1 — Review Current AWS Environment

Open:

AWS Console

↓

AWS Organizations

Determine:

Is AWS Organizations enabled?
Is this the Management Account?
How many AWS accounts exist?
Are Organizational Units already configured?

CLI

aws organizations describe-organization

Step 2 — Create AWS Organization

If an organization does not already exist:

Navigate to:

AWS Organizations

↓

Create Organization

Choose:

All Features

Verify:

Organization created successfully
Management account identified

CLI

aws organizations describe-organization

Step 3 — Create Organizational Units (OUs)

Create the following Organizational Units:

Production

Development

Security

Shared Services

Sandbox

Console:

AWS Organizations

↓

Organizational Units

↓

Create OU

CLI Example

aws organizations create-organizational-unit \
--parent-id r-xxxx \
--name Production

Repeat for each OU.

Step 4 — Create Member Accounts

Create the following AWS accounts:

production-account

development-account

security-account

logging-account

shared-services-account

sandbox-account

Console:

AWS Organizations

↓

Accounts

↓

Add AWS Account

Assign each account to the appropriate OU.

Step 5 — Verify Organizational Structure

Confirm:

Management Account

│

├── Production OU

├── Development OU

├── Security OU

├── Shared Services OU

└── Sandbox OU

CLI

aws organizations list-organizational-units-for-parent \
--parent-id r-xxxx

Step 6 — Configure Consolidated Billing

Navigate to:

Billing

↓

Billing Preferences

Verify:

Consolidated Billing Enabled
Management Account receives billing reports

Discuss:

Cost optimisation
Centralised billing
Financial governance

Step 7 — Create Service Control Policies (SCPs)

Create the following SCPs:

Deny Root User Actions

Restrict Unsupported Regions

Protect CloudTrail

Protect Security Hub

Protect GuardDuty

Console:

AWS Organizations

↓

Policies

↓

Service Control Policies

Attach SCPs to the relevant OUs.

Step 8 — Configure Security Services

Enable:

AWS CloudTrail
AWS Config
AWS Security Hub
Amazon GuardDuty

Discuss:

Centralised findings
Security monitoring
Compliance reporting

Step 9 — Configure Centralised Logging

Create a dedicated Logging Account.

Ensure:

CloudTrail logs are stored centrally
AWS Config records are centralised
Log retention policies are defined

Discuss:

Security investigations
Compliance requirements
Long-term log retention

Step 10 — Review Delegated Administration

Review services supporting delegated administration.

Discuss:

AWS Security Hub
AWS Config
GuardDuty
IAM Identity Center

Questions:

Why should administration be delegated?
Which account should own security services?

Step 11 — Validate the Environment

Verify:

AWS Organization created
Organizational Units created
Member Accounts created
SCPs attached
Consolidated Billing enabled
Central Logging configured
Security services enabled

CLI

aws organizations list-accounts

aws organizations list-policies

🧪 Enterprise Challenge

CloudNova Technologies plans to expand into Europe and Asia.

Design an AWS Organization capable of supporting:

300 AWS Accounts
Multiple Business Units
Regional Workloads
Centralised Security Operations
Compliance Requirements
Development Teams
Production Workloads
Disaster Recovery

Prepare an enterprise-ready organizational design.

📄 Deliverables

Capture screenshots of:

AWS Organizations Dashboard
Organizational Units
Member Accounts
Service Control Policies
Billing Configuration
CloudTrail
Security Hub
GuardDuty

Submit:

AWS Organization Diagram
Organizational Unit Structure
SCP Summary
Governance Strategy

🧹 Cleanup

Do NOT delete:

AWS Organization
Organizational Units
Member Accounts
Service Control Policies

These resources form the foundation for future modules.

Delete only:

Temporary test accounts (if created)
Experimental SCPs
Temporary policies

✅ Runbook Checklist

💡 Lessons Learned

What did you learn?

Why do enterprises use multiple AWS accounts?

How do Service Control Policies improve governance?

What are the benefits of centralised security services?

🚀 Next Enterprise Runbook

Enterprise Runbook 02 — Enterprise AWS Organizations Security Assessment

In the next runbook, you will assess an existing multi-account AWS environment, identify governance and security weaknesses, evaluate Service Control Policies, review account structures, and produce an executive security assessment report similar to those performed by Cloud Security Consultants.