AWS Organizations

AWS Organizations 用来做:
    centralized account management
    OU-based account grouping
    consolidated billing
    organization-wide policy guardrails
    delegated administrator for security / audit services
    organization CloudTrail / GuardDuty / Security Hub / Config integration

AWS Organizations 不负责:
    workload runtime
    app-level permission
    network isolation by itself
    replacing IAM policy
    replacing Control Tower account vending / landing zone automation

management account:
    only for organization, billing, identity center, emergency admin
    do not run workload
    do not create daily-use IAM users

member account:
    one account = one strong blast-radius boundary
    workload, environment, security tooling, logging should be separated

OU:
    policy inheritance boundary
    do not model company org chart blindly
    model security and operational requirements

SCP:
    guardrail only
    never grants permission
    applies to member accounts, not management account

effective permission mental model:
    IAM identity/resource policy must allow
    permissions boundary must allow, if used
    SCP path must allow
    RCP path must allow, if used
    explicit deny always wins

AWS Organizations
├── Security
│   ├── log-archive
│   └── security-tooling
├── Infrastructure
│   ├── network
│   └── shared-services
├── Workloads
│   ├── Dev
│   │   └── app-dev
│   ├── UAT
│   │   └── app-uat
│   └── Prod
│       └── app-prod
├── Sandbox
│   └── engineer-sandbox
└── Suspended
    └── closed-or-quarantined-account

separate by:
    environment: dev / uat / prod
    security criticality: security / log / network / workload
    access model: sandbox vs production
    lifecycle: active vs suspended

avoid:
    one account for everything
    OU based only on team name
    attaching strict SCP to root without test OU
    putting security logs in workload accounts

SCP important:
    does not grant permissions
    applies to IAM users and roles in member accounts
    also affects member account root user
    does not affect management account
    does not restrict service-linked roles
    FullAWSAccess is attached by default

RCP important:
    works on resources instead of principals
    useful when resource exposure must be centrally constrained
    use together with SCP when both principal and resource guardrails matter

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Sid": "DenyRootUser",
      "Effect": "Deny",
      "Action": "*",
      "Resource": "*",
      "Condition": {
        "StringLike": {
          "aws:PrincipalArn": "arn:aws:iam::*:root"
        }
      }
    }
  ]
}

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Sid": "DenyLeaveOrganization",
      "Effect": "Deny",
      "Action": "organizations:LeaveOrganization",
      "Resource": "*"
    }
  ]
}

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Sid": "DenyDisableSecurityBaseline",
      "Effect": "Deny",
      "Action": [
        "cloudtrail:StopLogging",
        "cloudtrail:DeleteTrail",
        "cloudtrail:UpdateTrail",
        "config:DeleteConfigurationRecorder",
        "config:StopConfigurationRecorder",
        "guardduty:DeleteDetector",
        "guardduty:DisassociateFromAdministratorAccount",
        "securityhub:DisableSecurityHub",
        "securityhub:DisassociateFromAdministratorAccount",
        "access-analyzer:DeleteAnalyzer"
      ],
      "Resource": "*",
      "Condition": {
        "ArnNotLike": {
          "aws:PrincipalArn": [
            "arn:aws:iam::*:role/OrganizationSecurityAdmin",
            "arn:aws:iam::*:role/AWSReservedSSO_BreakGlassAdmin_*"
          ]
        }
      }
    }
  ]
}

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Sid": "DenyIAMUsersAndAccessKeysInProd",
      "Effect": "Deny",
      "Action": [
        "iam:CreateUser",
        "iam:CreateLoginProfile",
        "iam:CreateAccessKey",
        "iam:UpdateAccessKey",
        "iam:AttachUserPolicy",
        "iam:PutUserPolicy"
      ],
      "Resource": "*",
      "Condition": {
        "ArnNotLike": {
          "aws:PrincipalArn": [
            "arn:aws:iam::*:role/OrganizationSecurityAdmin",
            "arn:aws:iam::*:role/AWSReservedSSO_BreakGlassAdmin_*"
          ]
        }
      }
    }
  ]
}

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Sid": "QuarantineAccount",
      "Effect": "Deny",
      "Action": "*",
      "Resource": "*",
      "Condition": {
        "ArnNotLike": {
          "aws:PrincipalArn": [
            "arn:aws:iam::*:role/OrganizationSecurityAdmin",
            "arn:aws:iam::*:role/AWSReservedSSO_BreakGlassAdmin_*"
          ]
        }
      }
    }
  ]
}

export SECURITY_ACCOUNT_ID="111122223333"

aws organizations enable-aws-service-access \
  --service-principal guardduty.amazonaws.com

aws organizations register-delegated-administrator \
  --account-id "$SECURITY_ACCOUNT_ID" \
  --service-principal guardduty.amazonaws.com

aws organizations list-delegated-administrators

aws organizations list-aws-service-access-for-organization

management account:
    enable trusted access
    register delegated administrator
    emergency operation only

delegated admin account:
    configure service
    monitor findings
    operate daily security controls

aws organizations describe-organization
aws organizations list-roots
aws organizations list-accounts

export ROOT_ID="r-xxxx"

aws organizations create-organizational-unit \
  --parent-id "$ROOT_ID" \
  --name "Workloads"

aws organizations create-account \
  --email "aws-prod@example.com" \
  --account-name "app-prod" \
  --role-name "OrganizationAccountAccessRole"

aws organizations describe-create-account-status \
  --create-account-request-id "car-example"

export ACCOUNT_ID="444455556666"
export OLD_PARENT_ID="r-xxxx"
export NEW_OU_ID="ou-xxxx-yyyyyyyy"

aws organizations move-account \
  --account-id "$ACCOUNT_ID" \
  --source-parent-id "$OLD_PARENT_ID" \
  --destination-parent-id "$NEW_OU_ID"

aws organizations create-policy \
  --name "DenyLeaveOrganization" \
  --description "Deny member accounts from leaving the organization" \
  --type SERVICE_CONTROL_POLICY \
  --content file://deny-leave-org.json

aws organizations attach-policy \
  --policy-id "p-example" \
  --target-id "ou-xxxx-yyyyyyyy"

aws organizations list-policies-for-target \
  --target-id "ou-xxxx-yyyyyyyy" \
  --filter SERVICE_CONTROL_POLICY

aws organizations list-accounts-for-parent \
  --parent-id "ou-xxxx-yyyyyyyy"

management account:
    root MFA enabled
    no workload
    very few administrators
    use IAM Identity Center
    break-glass role documented and monitored
    billing and org operations only

member accounts:
    no IAM users in production
    no long-lived access keys for CI/CD
    use OIDC assume role for deployment
    use permission sets for human access
    enable CloudTrail / GuardDuty / Security Hub / Config baseline

organization:
    all features enabled
    organization trail enabled
    delegated admin for security services
    SCP tested in a test OU first
    account lifecycle documented

purpose:
    one central trail for management events from all member accounts
    log delivery to central S3 bucket
    easier Athena / SIEM / incident investigation

baseline:
    multi-region organization trail
    log file validation enabled
    SSE-KMS if key policy is correct
    S3 bucket in log-archive account
    bucket policy allows CloudTrail delivery
    lifecycle retention configured

{
  "source": ["aws.organizations"],
  "detail-type": ["AWS API Call via CloudTrail"],
  "detail": {
    "eventSource": ["organizations.amazonaws.com"],
    "eventName": [
      "CreateAccount",
      "MoveAccount",
      "CreateOrganizationalUnit",
      "DeleteOrganizationalUnit",
      "AttachPolicy",
      "DetachPolicy",
      "UpdatePolicy",
      "EnableAWSServiceAccess",
      "DisableAWSServiceAccess",
      "RegisterDelegatedAdministrator",
      "DeregisterDelegatedAdministrator"
    ]
  }
}

organization:
    all features enabled
    OU structure documented
    account naming convention documented
    account owner tag / metadata maintained
    account vending process defined

access:
    IAM Identity Center enabled
    no daily management-account IAM users
    break-glass access tested
    production access uses permission sets / roles

guardrails:
    baseline SCP attached to Workloads OU
    stronger SCP attached to Prod OU
    quarantine SCP attached to Suspended OU
    SCP tested before attaching broadly
    policy size checked before rollout

security services:
    CloudTrail organization trail enabled
    GuardDuty organization admin delegated
    Security Hub organization admin delegated
    AWS Config strategy decided
    IAM Access Analyzer organization analyzer enabled

operations:
    create / move / close account runbook exists
    delegated admin inventory reviewed
    trusted access inventory reviewed
    CloudTrail alerts for org changes enabled
    quota usage reviewed before large account expansion

mistake:
    assume SCP grants permission
result:
    user still has no access because IAM policy did not allow it

mistake:
    run workloads in management account
result:
    SCP cannot protect those workloads

mistake:
    attach restrictive SCP to root without testing
result:
    many accounts lose required service access at once

mistake:
    use one prod account for every application
result:
    weak blast-radius isolation and noisy permissions

mistake:
    enable trusted access for many services without owner
result:
    unclear service integrations and difficult incident response

mistake:
    create accounts manually with no lifecycle process
result:
    orphan accounts, unclear billing, stale access