Design Solutions for Organizational Complexity

Assuming you know how IAM scopes access within one account, by the end of this domain you will be able to govern many at once, because at professional scale the account, not the VPC, is the hard boundary for security, billing, and fault isolation, so the first design decision for an organizationally complex workload is how to slice it across accounts (per workload, per environment, per team). Resources in one account are invisible to another unless you deliberately share them, and a compromise, runaway cost, or service-quota exhaustion is contained to the account it happens in. AWS Organizations stitches the accounts back together: an organization has one management account that pays the charges of all the member accounts, with accounts grouped into organizational units (OUs) that mirror your org structure. The recurring professional-exam instinct is to add a new account for a new isolation requirement rather than stretch one account with tags or IAM alone.

Organizations is where you express enterprise-wide intent: OUs for structure, and policies for guardrails. Service control policies (SCPs) and resource control policies (RCPs) are the central guardrails, and both are ceilings: per AWS, "No permissions are granted by an SCP". They cap the maximum available permissions, so the effective permission is the intersection of the SCP, any RCP, and the identity- or resource-based policy that actually grants access. Two facts trap candidates repeatedly: SCPs and RCPs require all-features mode (not consolidated-billing-only) and they do not affect the management account, which is exactly why the management account must stay nearly empty, but they do still apply to every member account, including one designated as a delegated administrator. RCPs go further by capping resource-based access, but only for a supported subset of services such as S3, STS, KMS, SQS, and Secrets Manager. If a scenario asks how to enforce a rule no account can escape, the answer is an SCP/RCP guardrail plus a granting policy, never the guardrail alone.

Organizational complexity is tamed by centralizing the cross-cutting concerns (networking, security, identity, billing, and backup) into purpose-built accounts while keeping the management account sacred. Networking centralizes through a hub: AWS Transit Gateway (default 5,000 attachments and 10,000 routes per TGW) for a Regional hub-and-spoke, AWS Cloud WAN for a global policy-driven backbone, and AWS Resource Access Manager (RAM) to share the TGW, subnets, or other resources across accounts instead of re-creating them. Security and governance services follow the delegated-administrator pattern: GuardDuty, Security Hub, IAM Access Analyzer, Firewall Manager, and Detective are run from a dedicated security/audit account with findings and logs fanned into a separate log-archive account. Identity centralizes in IAM Identity Center, and billing rolls up through consolidated billing, which shares volume pricing, Reserved Instance, and Savings Plans discounts across the whole org. The anti-pattern the exam punishes is putting any of this in the management account or duplicating it per workload account.

Rather than assembling Organizations, OUs, guardrails, centralized logging, and baseline IAM by hand, professionals start from a landing zone: a well-architected multi-account baseline. AWS Control Tower sets up and governs a multi-account environment, orchestrating AWS Organizations, AWS Service Catalog, and IAM Identity Center to build a landing zone, vend standardized accounts through Account Factory, and enforce preventive, detective, and proactive controls (guardrails) while detecting drift. Control Tower is an orchestration layer on top of Organizations. Anything it configures (OUs, SCPs, log-archive and audit accounts) you could build directly, but the landing zone gives you a tested baseline that scales as new accounts inherit OU policies on enrollment. The professional mindset is to make the org self-similar: a new team gets a vended account that automatically picks up the network share, security coverage, logging, and guardrails, with zero per-account manual setup.