Multi-Account Strategy

AWS Organizations enables centralized governance across multiple AWS accounts. A multi-account strategy separates workloads into purpose-specific accounts, reducing blast radius, simplifying access control, and enabling workload-specific compliance.

Organizational Units (OUs) group accounts by function, sensitivity, or regulatory requirement. A typical structure includes: Security OU (for logging and security services), Infrastructure OU (for shared services like DNS and directory), Sandbox OU (for experimentation), Workload OUs (for production, staging, development environments), and Policy Staging OU (for testing policies before production). For example, a financial services company might create separate OUs for PCI-scoped workloads, HIPAA workloads, and general workloads.

Account Types serve different purposes. The Management Account is the paying account and should be used only for billing and organizational management. Security accounts hold centralized security services like AWS Security Hub, GuardDuty, and CloudTrail. Logging accounts aggregate logs from all accounts. Shared Services accounts provide centralized resources like directory services, artifact repositories, and CI/CD pipelines.

Account Baselines standardize new account configurations. Use Control Tower or custom automation to provision new accounts with required security controls, networking, and monitoring. A baseline includes: CloudTrail configuration, VPC setup, IAM roles, Cost Allocation Tags, and required security services.

Service Control Policies (SCPs) restrict which AWS services and actions accounts can perform. SCPs in an OU apply to all accounts in that OU. For example, prevent production accounts from using services not approved by the security team, or restrict regions to those meeting data residency requirements. SCPs are permission boundaries that restrict but do not grant permissions.

Consolidated Billing aggregates all account charges to the management account, enabling volume discounts and Reserved Instance sharing across accounts. Use Cost Allocation Tags to track spending by account, team, or project. AWS Budgets can set spending alerts at the organization, OU, or individual account level.

AWS Control Tower provides a managed landing zone service that automates the setup of a secure, multi-account AWS environment. It applies ongoing governance through guardrails that detect and remedy policy violations.

Landing Zone is a multi-account environment that follows AWS best practices for security, operations, and networking. Control Tower sets up the landing zone with pre-configured OUs, accounts, and guardrails. The setup includes a log archive account, a security audit account, and an optional quarantine account.

Guardrails are preventive and detective controls applied across accounts. Preventive guardrails use SCPs to block actions before they occur, such as preventing S3 bucket creation without encryption. Detective guardrails use AWS Config rules to detect non-compliant resources after creation, such as identifying public S3 buckets. Control Tower provides pre-built guardrails for common compliance requirements.

Account Factory is a configurable account vending machine that provisions new accounts with pre-approved baselines. Users request accounts through a catalog, specifying the OU and customizations. The account factory applies guardrails, networking configuration, and account-specific settings automatically. This self-service model enables teams to provision compliant accounts in hours rather than weeks.

Guardrail Customization allows organizations to extend built-in guardrails with custom Config rules and SCPs. Create organization-specific guardrails for internal policies like mandatory tagging, approved AMI lists, or VPC configuration requirements.

Drift Detection identifies accounts or resources that have deviated from the landing zone configuration. When someone modifies a guardrail or disables a control, Control Tower detects the drift and alerts administrators.