# AWS Organizations

> One place to group, govern and pay for many AWS accounts at once.

- Level: Intermediate
- Topics: AWS
- URL: https://tidbit.legios.com.ar/aws-organizations/
- In Spanish: [AWS Organizations](https://tidbit.legios.com.ar/es/aws-organizations/)

Companies rarely use a single AWS account. They keep one for production, one for testing, one per team or per client, because an account is the strongest wall AWS offers: what happens in one does not touch the others. **AWS Organizations** is the service that ties all those accounts together under one roof.

You create an organization from a **management account** and invite or create **member accounts**. You can arrange them in a tree of **organizational units** (OUs), like folders: `Production`, `Sandbox`, `Finance`. All of them land on one bill (**consolidated billing**), so the company pays once and sees the cost of each account separately.

The most powerful piece is the **service control policy** (SCP): a rule attached to an OU or account that sets the maximum of what anyone inside can do. For example, "no one in Sandbox can turn off CloudTrail" or "only these Regions are allowed". It does not grant permissions; it caps them, even for the account's own administrators. That is how a security team sets guardrails across hundreds of accounts without logging into each one.

## An analogy

A company with many branches. Each branch runs its own shop, but they share one accounting department, and head office can issue rules ("no branch opens after midnight") that no branch manager can override.

## Keep in mind

- Groups many AWS accounts under one management account.
- Accounts are arranged in organizational units, like folders.
- Consolidated billing puts every account on a single bill.
- Service control policies cap what accounts can do; they never grant access.

## Go deeper

- [What is AWS Organizations? (official docs)](https://docs.aws.amazon.com/organizations/latest/userguide/orgs_introduction.html)
- [AWS Organizations](https://aws.amazon.com/organizations/)

## Related terms

- [AWS account and billing](https://tidbit.legios.com.ar/aws-account-and-billing/): What an AWS account is, how you get charged, and how to avoid a surprise bill.
- [Sandboxing](https://tidbit.legios.com.ar/sandboxing/): Running a program in a closed box so it cannot harm anything outside it.
- [AWS CloudTrail](https://tidbit.legios.com.ar/aws-cloudtrail/): The logbook of an AWS account: who did what, when, and from where.
- [Regions and Availability Zones](https://tidbit.legios.com.ar/regions-and-availability-zones/): Where AWS physically lives: cities worldwide, each split into separate data centers.