AWS recommends spreading workloads across many accounts, because an account is a natural boundary for security, cost, and blast radius. This page covers why and how to split accounts, and AWS Organizations, which groups them and applies guardrails from one place.
Why many accounts
AWS recommends running workloads across many accounts: accounts are natural boundaries for security, cost, and blast radius. The legacy notes describe a consistent setup across five services.
| Concern | Setup |
|---|---|
| Structure | Organizations with OUs by environment; SCPs as deny lists; no workloads in the management account |
| Sign-in | IAM Identity Center in the management account, group-based assignments, external IdP with SCIM1 |
| Audit | An organization CloudTrail trail that member accounts cannot disable2 |
| Threat detection | GuardDuty in all accounts and Regions through a delegated administrator3 |
| Posture | Security Hub CSPM through a delegated administrator with cross-Region aggregation4 |
The common thread is that security services are operated from a delegated administrator account rather than the management account.5
How those findings flow onward is covered under the findings pipeline.
AWS Organizations
AWS Organizations manages multiple AWS accounts centrally: create or invite accounts, group them into organizational units (OUs), apply governance policies, share resources, and consolidate billing. It is a global service hosted in us-east-1.5
The tree
One root holds OUs, OUs hold accounts (nesting up to 5 levels), and policies such as SCPs attach anywhere to narrow, never grant, what accounts beneath can do. The management account is not subject to SCPs.
| Policy type | Purpose |
|---|---|
| Service control policies (SCPs) | Permission boundaries for member accounts |
| Resource control policies (RCPs) | Prevent unintended external access to resources |
| Tag, backup, AI opt-out, chat applications policies | Other governance |
As listed in the note.5
Practices
- Use many accounts as security, cost, and blast-radius boundaries; keep workloads out of the management account.
- Group accounts into OUs by environment and write SCPs as deny lists; IAM still grants permissions.
- Use delegated administrators (GuardDuty, Security Hub CSPM, Config, IAM Identity Center) instead of the management account, and an organization CloudTrail trail.5
Troubleshooting and limits
| Symptom | Check |
|---|---|
| Account creation fails | Account quota and at most 5 creations in progress |
| SCP has no effect | SCPs grant nothing and skip the management account |
| Cannot remove an account | Created accounts must be at least 4 days old; invitations expire after 15 days |
| API errors elsewhere | Call Organizations from us-east-1 |
As tabled in the note. Default limits include 10 accounts (adjustable up to 50,000), 2,000 OUs, SCPs up to 10,240 characters, and 10 SCPs per entity.5
Related
- Management and governance: Control Tower, Service Catalog, quotas, and resource sharing.
- Compliance and posture: Config, Inspector, Macie, Detective, and Artifact.
- Domain index: other pages in this domain.