AWS Account Structures
Recognize the various account structures in relation to AWS billing and pricing
What you will learn
- Explain the benefit of consolidated billing via AWS Organizations.
- Explain organizational units' role in grouping accounts and applying unified policies.
- Distinguish the reason for creating multiple accounts (isolation) from the reason for consolidating billing (savings).
- Explain what a Service Control Policy (SCP) does at the organizational unit level.
A small company might get by with one AWS account, but as the team grows, splitting work across multiple accounts (production, testing, development, per team) becomes the actual standard — and the question becomes: how are these multiple accounts managed together without turning into administrative chaos?
The core concepts
| AWS Organizations | A service for centrally managing multiple AWS accounts together — consolidated billing, unified policies, and organizational units. |
|---|---|
| Consolidated Billing | Aggregating all accounts' consumption under one bill, so combined usage may reach cheaper pricing tiers. |
| Organizational Unit (OU) | A logical grouping of similar accounts (like all production accounts) to apply a unified policy to them all at once. |
| Service Control Policy (SCP) | A policy that sets a hard ceiling on the permissions allowed within an account or an entire organizational unit — even that account's admin cannot exceed it. |
The reason for isolation vs. the reason for consolidation
| Separate accounts (isolation) | Consolidated billing (consolidation) | |
|---|---|---|
| Goal | Containing the impact of any mistake or breach within a single account | Benefiting from combined-usage volume discounts, while cost tracking per account stays separate |
| Where it's configured | The decision to create a separate account per environment or team | The Consolidated Billing feature inside AWS Organizations itself |
What matters on the exam
- Isolation (separate accounts) and consolidation (unified billing) are not contradictory — most organizations use both together via Organizations.
- An SCP sets a ceiling no IAM policy inside the account can exceed — even if a user is granted full IAM permission, the OU-level SCP remains the actual maximum.
An SCP is not a substitute for IAM policies
An SCP sets a hard ceiling ("no one here can do this no matter their permission"), but it does not grant permissions itself. IAM policies are still what actually grants a user permission to perform a specific task within that ceiling.
Quick check
Answer in your head first, then reveal.
What is the benefit of consolidated billing?Reveal the answer
Combining all accounts' usage to potentially reach cheaper pricing tiers, with cost tracking kept separate per account.
Can an IAM policy inside an account exceed the SCP ceiling imposed on its organizational unit?Reveal the answer
No — an SCP is a hard ceiling no IAM policy can exceed.
What is an Organizational Unit (OU)?Reveal the answer
A logical grouping of similar accounts to apply a unified policy to them all at once.
Sign in to track your progress on this topic.
Your next step
Read the lesson, then mark it complete
Sources
Used to verify the facts. The writing is original to Passuit.