Architecture note2 lab guides2 lab guides
Organizations · AWS Organizations
Multi-account structure, organizational units, service control policies, delegated administration, and consolidated billing.
Outcome
- Explain the difference between ALL_FEATURES and CONSOLIDATED_BILLING org feature sets
- Explain why SCPs don't apply to the management account
- Explain how SCP inheritance works across Root, OUs, and accounts
- Explain why FullAWSAccess must stay attached for member accounts to function
- Explain when region restrictions need NotAction for global services
- Explain the delegated administrator pattern for Security Hub and other services
- Explain why invited standalone accounts are safer lab members than create-account
- Created an organization with ALL_FEATURES and captured ORG_ID and ROOT_ID
- Inspected the default FullAWSAccess SCP and verified it is attached to Root
- Built a multi-level OU hierarchy (Security, Infrastructure, Workloads/Prod/SDLC, Sandbox, Suspended)
- Tagged OUs for cost allocation metadata
- Wrote and attached three custom SCPs (region, security protection, sandbox cost)
- Inspected the effective SCP stack on Root, Workloads, and Prod OUs
- Observed DuplicatePolicyAttachmentException and PolicyDocumentSizeExceededException
- Invited an existing standalone account and accepted the handshake from MEMBER_PROFILE
- Moved the member account between OUs and confirmed SCP denials from MEMBER_PROFILE
- Removed the member account with remove-account-from-organization before org deletion
- Created an organization CloudTrail trail with trusted access enabled
- Cleaned up in order: member account, SCPs, OUs, CloudTrail, organization