Using AWS Organizations as part of your guidance
AWS Organizations is a service that helps you consolidate multiple AWS accounts for ease of management and billing. Not only does AWS Organizations help you create new accounts under the organizational umbrella quickly and easily, but it also provides features for governance that are not available in a standalone AWS account.
The two features of relevance to IAM are OUs and SCPs.
Separation with OUs
To understand OUs, we need to initially look at two basic concepts, as follows:
- Organization
- Root
An organization is an entity that you create to unify the different AWS accounts under your control so that you can oversee them as a single unit. There is one master account assigned to an organization that can then branch off into zero or more units. Many times, organizations are organized in a tree-like configuration, with the root account at the top and the OUs and child accounts branching out underneath.
...
