AWS Organizations: Using Multiple Accounts, OUs and Service Control Policies

The author extends their AWS setup beyond a single account, arguing that separate accounts act as strong boundaries for security, cost and blast radius. The guide explains key terms such as organizations, management and member accounts, OUs, and service control policies (SCPs). It notes that accounts roll up to one consolidated bill, that SCPs only restrict permissions and never grant them, and that they do not apply to the management account. Suggested steps include creating an organization, enabling MFA on the management root user, and setting up a Sandbox OU with a deny policy. Common mistakes to avoid include running workloads in the management account and reusing email addresses across accounts.