> ## Documentation Index
> Fetch the complete documentation index at: https://docs.quiverstone.io/llms.txt
> Use this file to discover all available pages before exploring further.

# Organization Configuration

A guide to configuring and structuring your AWS Organization for multi-account governance.

AWS Organizations is the foundation for managing multiple AWS accounts under a single governance model. Proper configuration ensures consistent security policies, cost allocation, and operational visibility across your entire environment.

***

## **Organization Structure**

A well-designed organizational unit (OU) hierarchy enables you to apply policies at the right level of granularity.

### **Recommended OU Structure**

```
Root
├── Security
│   ├── Audit (Log Archive)
│   └── Security Tooling
├── Infrastructure
│   ├── Shared Services
│   └── Networking
├── Workloads
│   ├── Production
│   ├── Staging
│   └── Development
├── Sandbox
│   └── Individual Developer Accounts
└── Suspended
    └── Decommissioned Accounts
```

### **Design Principles**

* **Separate security from workloads**: Security accounts (audit, log archive) should be in their own OU with strict SCPs.
* **Environment isolation**: Production, staging, and development workloads in separate OUs allow different policy sets.
* **Sandbox for experimentation**: Give developers a safe space with spend limits but relaxed controls.
* **Suspended OU**: Move accounts here before deletion to ensure all SCPs deny actions while you audit.

***

## **Enabling Organization Features**

Ensure your organization has **all features** enabled (not just consolidated billing):

```bash theme={null}
aws organizations describe-organization
```

Look for `"FeatureSet": "ALL"`. If you see `"CONSOLIDATED_BILLING"`, enable all features:

```bash theme={null}
aws organizations enable-all-features
```

***

## **Service Control Policies (SCPs)**

SCPs are the primary governance mechanism. They define the maximum permissions available to accounts within an OU.

### **Common SCPs**

| Policy                  | Purpose                                     | Applied To                |
| :---------------------- | :------------------------------------------ | :------------------------ |
| Deny Root User Actions  | Prevent root user usage in member accounts  | All OUs except management |
| Deny Region Access      | Restrict workloads to approved regions only | Workloads OU              |
| Deny Leave Organization | Prevent accounts from leaving the org       | Root (all accounts)       |
| Require Encryption      | Deny creation of unencrypted resources      | Production OU             |
| Deny Public S3          | Block public access on S3 buckets           | All OUs                   |

### **SCP Best Practices**

* Start with a **deny-list** approach: allow everything by default, explicitly deny what's not permitted.
* Test SCPs in the Sandbox OU before rolling to production.
* Never attach restrictive SCPs directly to the root — use OUs for granularity.
* Keep the management account free of restrictive SCPs (it is always exempt from SCPs by design, but avoid confusion).

***

## **Delegated Administrators**

Delegate service administration to member accounts so the management account remains minimal:

| Service                 | Delegate To              |
| :---------------------- | :----------------------- |
| AWS Security Hub        | Security Tooling account |
| Amazon GuardDuty        | Security Tooling account |
| AWS Config (Aggregator) | Audit account            |
| AWS Firewall Manager    | Security Tooling account |
| AWS IAM Identity Center | Infrastructure account   |

```bash theme={null}
aws organizations register-delegated-administrator \
  --account-id 111111111111 \
  --service-principal securityhub.amazonaws.com
```

***

## **Tag Policies**

Enforce consistent tagging across all accounts:

```json theme={null}
{
  "tags": {
    "Environment": {
      "tag_key": {
        "@@assign": "Environment"
      },
      "tag_value": {
        "@@assign": ["production", "staging", "development", "sandbox"]
      },
      "enforced_for": {
        "@@assign": ["ec2:instance", "s3:bucket", "rds:db"]
      }
    }
  }
}
```

***

## **Trusted Access**

Enable trusted access for AWS services that need organization-wide visibility:

* AWS CloudFormation StackSets
* AWS Config
* AWS CloudTrail (organization trail)
* AWS Backup
* AWS RAM (Resource Access Manager)

```bash theme={null}
aws organizations enable-aws-service-access \
  --service-principal config.amazonaws.com
```

***

## **Consolidated Billing & Cost Allocation**

* Enable **Cost Allocation Tags** in the management account billing console.
* Use **AWS Cost Explorer** for cross-account cost visibility.
* Set up **AWS Budgets** at both the organization and individual account levels.

***

## **Next Steps**

* [New AWS Account Setup](/consulting/management-governance/accounts/new-aws-account)
* [Configure AWS Alternate Contacts](/consulting/management-governance/accounts/configure-aws-alternate-contacts)
* [Resource Tagging Strategy](/consulting/management-governance/convention/resource-tagging-strategy)
* [Core Compliance](/consulting/management-governance/security/core-compliance)