AWS Organizations
One place to group, govern and pay for many AWS accounts at once.
Companies rarely use a single AWS account. They keep one for production, one for testing, one per team or per client, because an account is the strongest wall AWS offers: what happens in one does not touch the others. AWS Organizations is the service that ties all those accounts together under one roof.
You create an organization from a management account and invite or create member accounts. You can arrange them in a tree of organizational units (OUs), like folders: Production, Sandbox, Finance. All of them land on one bill (consolidated billing), so the company pays once and sees the cost of each account separately.
The most powerful piece is the service control policy (SCP): a rule attached to an OU or account that sets the maximum of what anyone inside can do. For example, "no one in Sandbox can turn off CloudTrail" or "only these Regions are allowed". It does not grant permissions; it caps them, even for the account's own administrators. That is how a security team sets guardrails across hundreds of accounts without logging into each one.
Keep in mind
- Groups many AWS accounts under one management account.
- Accounts are arranged in organizational units, like folders.
- Consolidated billing puts every account on a single bill.
- Service control policies cap what accounts can do; they never grant access.
