AWSSAP-C02
On this page

Multi-Account Strategy & AWS Organizations

A recurring SAP-C02 theme (Domain 1: Design Solutions for Organizational Complexity) is designing and governing a multi-account AWS environment. Know the building blocks and when each applies.

The layers

  • AWS Organizations — the container for many accounts, grouped into Organizational Units (OUs), governed by Service Control Policies (SCPs). Remember: an SCP is a guardrail (a ceiling) — it never grants, and it never applies to the management account.
  • AWS Control Tower — an opinionated, automated landing zone on top of Organizations: baseline guardrails, Account Factory for vending governed accounts, and centralized logging/audit.
  • IAM Identity Center — workforce SSO across accounts via permission sets (which materialize as IAM roles in each account). Requires Organizations.
  • AWS RAM (Resource Access Manager) — share resources (subnets, Transit Gateway, Route 53 Resolver rules, License Manager) across accounts. RAM shares resources, not IAM roles.

Cross-account access

  • Assume a role in the target account (a role there trusts the caller's principal; caller calls sts:AssumeRole for temporary credentials). This is the least-privilege, no-long-term-keys pattern, and it's revocable by editing the target role.
  • A resource with a resource policy (S3, KMS, SQS, SNS, …) can grant another account directly; cross-account access needs both the identity policy (caller) and the resource policy (target).

Networking across accounts

  • Transit Gateway — hub-and-spoke connectivity for many VPCs/accounts (scales far better than full-mesh VPC peering, which is N² and non-transitive). Common for centralized egress/inspection (route spokes' 0.0.0.0/0 through a central inspection VPC with AWS Network Firewall + NAT).
  • VPC peering — 1:1, non-transitive; fine for a few VPCs, not for a large mesh.
  • PrivateLink — private access to a specific service across accounts/VPCs (works with overlapping CIDRs); not general routing or internet egress.

Exam reflexes

  • "Govern many accounts + guardrails + vend new governed accounts" → Control Tower (on Organizations). "Just guardrails/SCPs on accounts" → Organizations.
  • "Central inspected internet egress for many VPCs" → Transit Gateway + central egress/inspection VPC.
  • "Least-privilege cross-account access, temporary creds" → role in the target account + AssumeRole.
  • "Share a subnet / Transit Gateway across accounts" → AWS RAM (shares resources, not roles).
  • SCPs cap, never grant; and never touch the management account — restrict the management account with IAM instead.