Central governance and management across AWS accounts.
AWS Organizations helps you centrally govern your environment as you grow and scale your workloads on AWS. Whether you are a growing startup or a large enterprise, Organizations helps you to centrally manage billing; control access, compliance, and security; and share resources across your AWS accounts.
Using AWS Organizations, you can automate account creation, create groups of accounts to reflect your business needs, and apply policies for these groups for governance. You can also simplify billing by setting up a single payment method for all of your AWS accounts. Through integrations with other AWS services, you can use Organizations to define central configurations and resource sharing across accounts in your organization. AWS Organizations is available to all AWS customers at no additional charge.
CENTRALLY MANAGE POLICIES ACROSS MULTIPLE AWS ACCOUNTS
To improve control over your AWS environment, you can use AWS Organizations to create groups of accounts, and then attach policies to a group to ensure the correct policies are applied across the accounts without requiring custom scripts and manual processes.
GOVERN ACCESS TO AWS SERVICES, RESOURCES, AND REGIONS
AWS Organizations allows you to restrict what services and actions are allowed in your accounts. You can use Service Control Policies (SCPs) to apply permission guardrails on AWS Identity and Access Management (IAM) users and roles. For example, you can apply an SCP that restricts users in accounts in your organization from launching any resources in regions that you do not explicitly allow.
AUTOMATE AWS ACCOUNT CREATION AND MANAGEMENT
AWS Organizations helps you simplify IT operations by automating AWS account creation and management. The Organizations APIs enable you to create new accounts programmatically, and to add the new accounts to a group. The policies attached to the group are automatically applied to the new account. For example, you can automate the creation of new accounts for workload or application isolation and grant entities in those accounts access only to the necessary AWS services.
CONFIGURE AWS SERVICES ACROSS MULTIPLE ACCOUNTS
AWS Organizations helps you configure AWS services and share resources across accounts in your organization. For example, Organizations integrates with AWS Single Sign-on to enable you to easily provision access for all of your developers to accounts in your organization from a single place. You can make central changes to access permissions and have them automatically updated on accounts in your organization.
CONSOLIDATE BILLING ACROSS MULTIPLE AWS ACCOUNTS
You can use AWS Organizations to set up a single payment method for all the AWS accounts in your organization through consolidated billing. With consolidated billing, you can see a combined view of charges incurred by all your accounts, as well as take advantage of pricing benefits from aggregated usage, such as volume discounts for Amazon EC2 and Amazon S3.
Use cases
IMPLEMENT AND ENFORCE CORPORATE SECURITY, AUDIT, AND COMPLIANCE POLICIES
Use AWS Organizations to implement Service Control Policy (SCP) permission guardrails to ensure that users in your accounts can only perform actions that meet your corporate security and compliance policy requirements. Additionally, you can configure central logging of all actions performed across your organization using AWS CloudTrail and centrally aggregate data for rules that you’ve defined using AWS Config, enabling you to audit your environment for compliance and react quickly to changes.
SHARE RESOURCES ACROSS ACCOUNTS
AWS Organizations makes it easy for you to share critical central resources across your accounts. For example, you can share your central AWS Directory Service Managed Active Directory with all accounts in your organization for applications to access your central identity store. Additionally, you can ensure application resources across your accounts are created on your AWS Virtual Private Cloud (VPC) subnets by centrally defining them once and sharing them across your organization using AWS Resource Access Manager.