AWS Organizations

AWS Organizations:

Centrally manage and govern your environments as you scale your AWS resources. It is mainly used to manage many AWS account in a larger enterprise. Before using service, enterprises managed separate billing & payment methods for each account. Now with this service single account (Management or Master) managing the other account(member) related activities on this organization account and another important benefit is single consolidated billings for AWS organization.

Using management account, we can invite other accounts to join under this and member account should accept the invitation to be part of AWS organization. Also, from management account can create new account as well. With the login of management account we can switch to other accounts using “Switch role” option in AWS console.

Benefits:

• Quickly scale your workloads
• Provide custom environments for different workloads
• Centrally secure and audit your environment across accounts
• Simplify permission management and access control
• Efficiently provision resources across accounts
• Manage costs and optimize usage

Use Cases:

• Automate the creation of AWS accounts and categorize workloads using groups
• Implement and enforce audit and compliance policies
• Provide tools and access for your security teams while encouraging development
• Share common resources across accounts

With AWS Organizations you can perform account management activities at scale by consolidating multiple AWS accounts into a single organization. Consolidating accounts simplifies how you use other AWS services. You can leverage the multi-account management services available in AWS Organizations with select AWS services to perform tasks on all accounts that are members of your organization.

Trusted Access – You can enable a compatible AWS service to perform operations across all of the AWS accounts in your organization. For more information, see Using AWS Organizations with other AWS services.

Delegated Administrator – A compatible AWS service can register an AWS member account in the organization as an administrator for the organization's accounts in that service.

AWS Organizations is available in all AWS commercial regions, AWS GovCloud (US) regions, and China regions The service endpoints for AWS Organizations are located in US East (N. Virginia) for commercial organizations and AWS GovCloud (US-West) for AWS GovCloud (US) organizations, and AWS China (Ningxia) region, operated by NWCD.

Best Practices:

• Use OUs to manage member accounts
• Separate the management account and member accounts
• Move accounts between OUs when needed
• Restrict the root user in member accounts

A well-architected multi-account strategy helps you innovate faster in AWS, while helping you meet your security and scalability needs. The framework described in this blog post represents AWS best practices that you should use as a starting point for your AWS journey.

Creating an organization is simple.

1. Select (or create) an account to manage your organization (we recommend using an account that does not run existing workloads). This will be the management (formerly known as master) account for your organization
2. Visit the AWS Organizations page on the console
3. Choose “Create Organization.” Your organization is now created
4. Verify the email address of the management account

Once you’ve created the organization and verified your email, you can create or invite other accounts into your organization, categorize the accounts into Organizational Units (OUs), create service control policies (SCPs), and take advantage of the Organizations features from supported AWS services. You can also create an organization via CLI or API.

All the very best Cloud babies and you can reach me on LinkedIn if you need any assistance.

Check my personal AWS Blogsite here.