Governance with SCP

You learned how you can set up a multi-account structure using AWS Organizations in Chapter 2, Establishing the Right Account Structure. You also saw how to group accounts into OUs to model your organization’s structure and separate your AWS accounts. This helps to logically organize your AWS accounts and cloud assets to make things easier for chargebacks, application boundaries, and governance.

Governance helps you apply the right permission boundaries to logically grouped AWS accounts. For instance, a group of AWS accounts meant for sandbox and AWS service exploration should comply to different rules than a group of AWS accounts meant to hold production workloads. AWS Organizations helps you apply these governance rules using permission boundaries.

You can apply permission boundaries to an OU to govern what actions principals can take under the OU. Any policies applied to an OU trickle down to affect any accounts tied to the OU, and even sub-OUs and...