AWS Organizations

Question 1

What benefits does AWS Organizations provide?

Answer 1

Consolidation of AWS billing (including using a single payment method).

Consolidation of reservations and volume discounts.

Service Control Policies

Question 2

What is a Management Account?

Answer 2

A Management Account is the account that you use to create the organization. From the organization’s management account, you can do the following:

1. Create accounts in the organization
2. Invite other existing accounts to the organization
3. Remove accounts from the organization
4. Designate delegated administrator accounts
5. Manage invitations
6. Apply policies to entities (roots, OUs, or accounts) within the organization
7. Enable integration with supported AWS services to provide service functionality across all of the accounts in the organization.

The management account has the responsibilities of a payer account and is responsible for paying all charges that are accrued by the member accounts. You can’t change an organization’s management account.

Question 3

What do you call an AWS account that joins an Organization?

Answer 3

A Member Account.

Question 4

What can be contained in the Organization Root?

Answer 4

Organizational Units (OU) or AWS accounts (both the Management Account and Member Accounts).

Question 5

What are the two ways to add an AWS account to an Organization?

Answer 5

By inviting an existing AWS account to join the Organization or by creating a new AWS account directly within the Organization.

Question 6

What does Role Switching do?

Answer 6

It allows a user to assume the role of another user within an Organization through the console GUI.

Question 7

What are Service Controls Policies (SCP)?

Answer 7

They establish permissions for a Member AWS account within an Organization. This has the effect of limiting what the root user of that account can do because the SCP limits the entire account. SCPs do not grant permission to identities within the account, they simply limit what the account as a whole can do.

Question 8

Is the Management Account impacted by Service Control Policies?

Answer 8

No.