Organizations, Landing Zones, SCPs and RCPs

What it is

An AWS account is the strongest isolation boundary you get, so large companies use hundreds of them. The exam tests how to arrange them, create new ones in a governed way, and set limits no account administrator can remove.

AWS Organizations provides the account tree and policies, AWS Control Tower builds and governs a landing zone on top, and AWS Resource Access Manager (RAM) shares resources across accounts.

How it works

Designing the OU structure

Group accounts by the controls they need, not by the org chart. A common layout has a Security OU (log archive and security tooling), an Infrastructure OU (networking and shared services), Workloads OUs split into production and non-production, and a Sandbox OU with looser rules.

Keep workloads out of the management account, because policies do not restrict it. Use delegated administrator accounts for GuardDuty, Security Hub and Config.

AWS Control Tower landing zone

Control Tower sets up a multi-account environment that follows best practices. It creates a Security OU with a Log Archive account and an Audit account, and it centralizes CloudTrail and Config logs.

Control Tower applies controls (guardrails) to OUs.

Controls are also grouped as mandatory, strongly recommended or elective. A Region deny control limits which Regions accounts can use, which matters for data residency.

Automated account provisioning

Account Factory creates new accounts that are enrolled in Control Tower, placed in an OU and baselined automatically. Account Factory Customization adds a blueprint, so a new account arrives with standard resources already deployed.

Account Factory for Terraform (AFT) runs account requests through a GitOps pipeline. Choose it when the company already uses Terraform and wants account requests reviewed as code.

Service control policies (SCPs)

An SCP sets the maximum permissions for IAM users and roles in member accounts, including the root user. It never grants anything, so an IAM policy must still allow the action.

SCPs do not affect the management account, and they do not restrict service-linked roles. For an action to be available, an SCP must allow it at every level from the root down to the account; a deny at any level applies to everything below.

A deny list keeps the default FullAWSAccess policy and adds explicit denies, which is easy to maintain. An allow list replaces it with approved services only, which is tighter but needs constant updates.

Typical SCP guardrails deny leaving the organization, stopping CloudTrail or using unapproved Regions.

Resource control policies (RCPs)

An RCP sets the maximum permissions for resources in member accounts, whoever the caller is, including principals outside your organization. SCPs restrict your principals; RCPs restrict access to your resources.

RCPs apply to a defined list of services, including Amazon S3, AWS STS, AWS KMS, Amazon SQS, AWS Secrets Manager, Amazon DynamoDB and Amazon ECR. Like SCPs, they never grant, they do not affect the management account, and they do not apply to service-linked roles or AWS managed KMS keys.

The classic RCP enforces an identity perimeter: deny access to S3 objects unless aws:PrincipalOrgID is your organization or the caller is an AWS service. One policy then protects every bucket, even one whose bucket policy allows the world.

Sharing resources with AWS RAM

RAM shares a resource with accounts, OUs or the whole organization without duplicating it. With sharing enabled for AWS Organizations, shares inside the organization need no invitation.

With Transit Gateway, the owner account controls the route tables, so segmentation (for example production cannot reach development) stays central even though attachments come from many accounts. In a shared VPC, participants manage their own instances and databases but cannot change the owner's subnets or route tables.

How the exam asks about this

• "Prevent any account, even with administrator access, from disabling CloudTrail or using Regions outside the EU." -> SCPs attached to the OUs, or Control Tower preventive controls including Region deny.
• "No principal outside the organization may access any S3 bucket, even if a bucket policy allows it." -> An RCP that denies S3 access when aws:PrincipalOrgID does not match.
• "Dozens of workload accounts need connectivity through one central hub with central routing control." -> Transit Gateway in a network account, shared with AWS RAM.