Note: This is the second post in my AWS SCS-C03 series. You can see the rest of the posts in the series using the link above.

• AWS Organisations allows you to centrally manage and govern an AWS environment.
  • To create an Organisation, you’ll need to create an Organisation using your AWS account (which will become the Management account) and invite other AWS accounts (Member accounts) you’d like to add to your Organisation.
  • Organisational Units (OUs) can be created to further simplify Organisations.
  • Policies can be assigned to OUs to administer what permissions the members of the Organisation have.
  • Once your Organisation has been created, a feature called Consolidated Billing kicks in. Consolidated Billing means you receive a single monthly bill for all the Member accounts within the overall Organisation, which simplifies costs.

• Service Control Policies (SCPs) allow you to centrally restrict the maximum available permissions allowed by IAM roles and users in your member accounts (Member accounts only – this does not apply to the Management account).
  • SCPs do not add or give permissions (they can only restrict them).
  • For example: if an IAM user within an organisation is given full access to S3 using an IAM policy, but an overarching SCP restricts access to S3, then that IAM user will have their access to S3 restricted.
  • SCPs do not affect service-linked roles. Service-linked roles are IAM roles that enable an AWS service to perform actions on your behalf. This can’t be restricted by an SCP.

Thanks for reading!

-J

More reading:

• AWS Organisations https://docs.aws.amazon.com/organizations/latest/userguide/orgs_introduction.html
• Service Control Policies https://docs.aws.amazon.com/organizations/latest/userguide/orgs_manage_policies_scps.html