AWS Organizations is an AWS service that allows administrators to centrally manage multiple AWS accounts. It helps consolidate billing and apply policies across accounts. Organizational Units can group similar accounts and Service Control Policies can restrict the AWS services and actions accounts are allowed to use. Using multiple accounts provides benefits like improved security by isolating resources and services in separate accounts.

1. AWS Organizations
Marcelo Serpa

2. Marcelo
Serpa
● Principal Software Architect
● Youtuber :D -> DevsDeValor
● AWS and GCP
● Java & DevOps
● Github: https://github.com/marceloserpa
+++
< design + inovação + software >

3. Multi-account strategy

4. Why use the multi-account
strategy?
< design + inovação + software >
+++
❏ Best practice
❏ Security Control
❏ Reduce the blast radius of the security incident
❏ Account as a container (Isolate)
❏ Cost allocation
❏ Governance
❏ Avoid service limits
Challenges
❏ Centralize Billing
❏ Complexity to manage the accounts
❏ How to monitor all accounts?

5. AWS Organizations

6. AWS organizations
< design + inovação + software >
+++
❏ Account management service
❏ Administer multiple accounts as a single unit
❏ Create new accounts / Invite existent accounts
❏ Apply policy to accounts
❏ Centralize billing
❏ Free

7. Organizational Units - OUs
< design + inovação + software >
+++
❏ Root account
❏ Create logical group and structure an hierarchy
❏ Apply policies
❏ OUs can be nested up to 5 levels deep

8. Service Control Policies (SCPs)
< design + inovação + software >
+++
❏ Organization policy
❏ Limit the AWS services, resources and API operations
that account member can use
❏ Allow and deny list

9. SCPs - Examples
< design + inovação + software >
+++
Prevent users from disabling CloudWatch or
altering its configuration
Prevent IAM users and roles from making
certain changes

10. Well-architected
< design + inovação + software >
+++

11. Organizational Units - OUs -
Benefits
< design + inovação + software >
+++
❏ Group similar accounts based on function
❏ Management policies
❏ Apply policy on multiples based on hierarchy
❏ Share resources (AWS RAM)

12. Account structure type
< design + inovação + software >
+++

13. PoC
< design + inovação + software >
+++

14. PoC
< design + inovação + software >
+++

15. Links
< design + inovação + software >
+++
❏ https://docs.aws.amazon.com/accounts/latest/reference/welcome-multiple-accounts.html
❏ https://jaychapel.medium.com/6-benefits-to-adopting-an-aws-multi-account-strategy-31d6b0ff8521
❏ https://repost.aws/questions/QUM1bqanJzTjKLt5lCPuEdSg/should-i-use-one-account-or-multiple-ac
counts
❏ https://docs.aws.amazon.com/whitepapers/latest/organizing-your-aws-environment/recommended-o
us-and-accounts.html
❏ https://aws.amazon.com/blogs/industries/defining-an-aws-multi-account-strategy-for-telecommunica
tions-companies/
❏ https://aws.amazon.com/blogs/security/how-to-use-service-control-policies-in-aws-organizations/
❏ https://docs.aws.amazon.com/organizations/latest/userguide/orgs_manage_policies_scps_examples.
html

16. Thanks!
< design + inovação + software >
+++
Marcelo Serpa
Principal Software Architect
marcelo.serpa@ilegra.com