Organizations and cross-account access

A serious AWS estate runs many accounts rather than one, because an account is the strongest isolation boundary AWS offers. This section covers how those accounts are organised, constrained and connected.

Start with Organizations, accounts, OUs and policies. It explains how accounts are grouped into organisational units, and what service control policies and resource control policies each restrict. One rule is worth knowing before writing any policy: service control policies never affect the management account, but they do apply to every member account — including a member account designated as a delegated administrator.

Once accounts are separated, work still has to cross between them. Cross-account role access replaces duplicated users and long-lived keys with roles that can be assumed. AWS Resource Access Manager shares resources such as subnets and transit gateways, so they are not duplicated in every account.

Detailed patterns for writing service control policies are in the AWS security section.