> For the complete documentation index, see [llms.txt](https://ysfang82.gitbook.io/development-notes/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://ysfang82.gitbook.io/development-notes/aws-notes/service/identity-and-federation/organizations.md).

# Organizations

**Introduction**

* Central governance (SCP / Consolidated billing) across AWS accounts
* Perform tasks in your organization and its accounts on your behalf
  * Use trusted access to enable an AWS service (trusted service. Ex. RAM)

**Usage**

* Master accounts must invite child accounts.
* Master accounts can create child accounts.
* Master can access child accounts with:
  * CloudFormation StackSets to create IAM roles in target accounts.
  * Assume the roles using the STS Cross Account capability.
* Can create a dedicated account for logging or security.
* [For a member to leave an organization](https://docs.aws.amazon.com/organizations/latest/userguide/orgs_troubleshoot_general.html#troubleshoot_general_error-leaving-org), check:
  * The member must enable IAM user access to billing.
  * The member must have the information required for it to operate as a standalone account. (Ex. permission of "organizations:DescribeOrganization" or "organizations:LeaveOrganization")
* API is available to automate AWS account creation.
* Integration with AWS SSO
* Consolidated Billing
  * Only master account can view / download the report (CSV), but report can be drill down by each member account.

**AWS Orginaizaion Options:**

* Consolidated billing features:
  * Consolidated billing across all accounts - single payment method.
  * Pricing benefits from aggregated usage.
* All Features (by default)
  * Includes consolidated billing features
  * Supports SCP
  * Child accounts must approve enabling all features.
  * Ability to apply an SCP to prevent member accounts from leaving the org.
  * Can't switch to Consolidated billing features only.

**Multi Account Strategies**

* Create account per department, per cost center, per dev / test / prod, based on regulatory restrictions (using SCP), for better limits, isolated account for logging.
* Multi Account vs One Account Multi VPC
* Use tagging standards for billing purposes
* Enable CloudTrail on all accounts, send logs to central S3 bucket
* Send CloudWatch Logs to central logging account
* Establish Cross account roles for admin purposes

**Service Control Policy (SCP)**

* Organization policy as whitelist or blacklist (allow all at top, then disable items) IAM actions
* Applied at the Root, OU or Account level.
* SCP is applied to all the users and roles of the account, including Root.
* The SCP doesn't affect [service-linked roles](https://docs.aws.amazon.com/IAM/latest/UserGuide/using-service-linked-roles.html).
* SCP must have an explicit allow (doesn't allow anything by default)
* **SCP dosen't related to resources.**
* **SCP dosen't grant any permission (just specify the maximum permissions).**
  * Permissions are granted with IAM
* Use cases:
  * Restrict access to certain services (for example: can't use EMR)
  * Enforce PCI compliance by explicitly disabling services.

**Reserved Instances / Savings Plans**

* The consolidated billing feature treats all the accounts in the organization as one account.
* Accounts in the organization can share benefits of RIs with any other account.
* The payer account (master account) can turn off RI discount / Savings Plans discount sharing for any accounts in that organization, including the payer account.
* RIs and Savings Plans discounts aren't shared between any accounts that have sharing turned off.
* To share an RI / Savings Plans discount with an account, both accounts must have sharing turned on. [The master account can turn off sharing](https://docs.aws.amazon.com/awsaccountbilling/latest/aboutv2/ri-turn-off.html) for any member account.

[**RI Consolidated Billing examples**](https://docs.aws.amazon.com/awsaccountbilling/latest/aboutv2/consolidatedbilling-other.html)

* For zonal RIs must have the same:
  * AZ (align with AZ id, not AZ name.)
* For zonal DB instances must have the same:
  * Engine, AZ, Instance Type, Deployment Type (ex. Multi-AZ)