AWSDOP-C02
On this page

Multi-Account Strategy & AWS Organizations

A recurring SAP-C02 theme (Domain 1: Design Solutions for Organizational Complexity) is designing and governing a multi-account AWS environment. Know the building blocks and when each applies.

The layers

  • AWS Organizations ā€” the container for many accounts, grouped into Organizational Units (OUs), governed by Service Control Policies (SCPs). Remember: an SCP is a guardrail (a ceiling) ā€” it never grants, and it never applies to the management account.
  • AWS Control Tower ā€” an opinionated, automated landing zone on top of Organizations: baseline guardrails, Account Factory for vending governed accounts, and centralized logging/audit.
  • IAM Identity Center ā€” workforce SSO across accounts via permission sets (which materialize as IAM roles in each account). Requires Organizations.
  • AWS RAM (Resource Access Manager) ā€” share resources (subnets, Transit Gateway, Route 53 Resolver rules, License Manager) across accounts. RAM shares resources, not IAM roles.

Cross-account access

  • Assume a role in the target account (a role there trusts the caller's principal; caller calls sts:AssumeRole for temporary credentials). This is the least-privilege, no-long-term-keys pattern, and it's revocable by editing the target role.
  • A resource with a resource policy (S3, KMS, SQS, SNS, ā€¦) can grant another account directly; cross-account access needs both the identity policy (caller) and the resource policy (target).

Networking across accounts

  • Transit Gateway ā€” hub-and-spoke connectivity for many VPCs/accounts (scales far better than full-mesh VPC peering, which is NĀ² and non-transitive). Common for centralized egress/inspection (route spokes' 0.0.0.0/0 through a central inspection VPC with AWS Network Firewall + NAT).
  • VPC peering ā€” 1:1, non-transitive; fine for a few VPCs, not for a large mesh.
  • PrivateLink ā€” private access to a specific service across accounts/VPCs (works with overlapping CIDRs); not general routing or internet egress.

Exam reflexes

  • "Govern many accounts + guardrails + vend new governed accounts" ā†’ Control Tower (on Organizations). "Just guardrails/SCPs on accounts" ā†’ Organizations.
  • "Central inspected internet egress for many VPCs" ā†’ Transit Gateway + central egress/inspection VPC.
  • "Least-privilege cross-account access, temporary creds" ā†’ role in the target account + AssumeRole.
  • "Share a subnet / Transit Gateway across accounts" ā†’ AWS RAM (shares resources, not roles).
  • SCPs cap, never grant; and never touch the management account ā€” restrict the management account with IAM instead.