AWS Organizations & Multi-Account Strategy
Consolidated billing, SCPs, and Control Tower — how companies manage many AWS accounts under one roof.
Real companies run many AWS accounts (per team, per environment). AWS Organizations manages them centrally: group accounts into organizational units (OUs), apply guardrails, and pay one consolidated bill.
Organizations benefits
- Consolidated billing — one invoice for all accounts, with combined usage tiers and shared volume discounts (and shared Reserved Instance/Savings Plans benefits).
- Service Control Policies (SCPs) — set the *maximum* permissions any identity in an account can have (e.g., deny leaving approved Regions). SCPs don't grant permissions, they limit them.
- Centralized creation and grouping of accounts into OUs.
- Account isolation is itself a best practice: blast radius, billing clarity, per-team autonomy.
Sets up and governs a secure multi-account environment (a landing zone) with pre-configured guardrails — Organizations plus best practices, automated.
Share resources (like subnets) across accounts.
Curated portfolios of approved products teams can self-serve deploy.
"Restrict what member accounts can do" → SCPs. "Single bill / volume discounts across accounts" → consolidated billing. "Quickly set up a governed multi-account environment" → Control Tower.
Which AWS Organizations feature combines usage across accounts to unlock volume discounts on a single invoice?