How to Create & Manage Multiple AWS Accounts with AWS Organizations
Tags: aws, organization, ou, multipleawsaccount
Published: 2022-04-12 07:34:26

**AWS Organization**: AWS Organizations is an account management service that enables you to consolidate multiple AWS accounts into an organization that you create and centrally manage. AWS Organizations includes consolidated billing and account management capabilities that enable you to better meet the budgetary, security, and compliance needs of your business. As an administrator of an organization, you can create accounts in your organization and invite existing accounts to join the organization.

## Create Organization
**Prerequisite**: To get started, you must first decide which of your AWS accounts will become the management account (formerly known as master account). 

You can either select an existing one. (AWS account that is not already a member of another organization.)
Or 
You can create a new one from here: 
[https://aws.amazon.com/console/](https://aws.amazon.com/console/)

![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/80ee6rvjwl592yb2e2gn.png)

Just follow the procedure. More detail [link](https://aws.amazon.com/premiumsupport/knowledge-center/create-and-activate-aws-account/)

**Sign in as an administrator** to the AWS Management Console using the AWS account you want to use to manage your organization.

**Go to the AWS Organization console**:

![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/56m4e43eprt26i8sn22c.png)

Click the `Create Organization` button.

![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/4nainah1uhh2e1ncx8h4.png)

It will `enable all` features of organization. If you want to enable only `consolidated billing only features` then click there. Selecting all features is recommended if you want to take advantage of all of the central management capabilities of AWS Organizations.

![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/6p4uw3u09b0t9ky8f9en.png)

Congratulations! You have successfully created an Organization.

Now you can create new AWS account or invite old account to be a member of that organization.


## Add AWS accounts to your organization

![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/yz758lwmgoek5inxlxez.png)
 

**You can add AWS accounts to your organization by using two methods**:
1. Invite existing AWS accounts to your organization by using their AWS account ID or associated email address.
2. Create new AWS accounts.

**Invite existing AWS accounts**: For that you have to loing using the root email or need to varity the root email.

![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/ckzjif98y88c4r4c3tkm.png)

It will send an invitaion of your root email address. 

![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/efbn8cxtqrvu171aanbb.png)

After varifying your root email you can able to send invitation:

![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/xge00enj5ha5zoiw0c7a.png)

You can send multiple invitations at one time.

**Create new AWS accounts**: 
You can create a new AWS account for your organization:

![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/29lrtd83tbr9fazvr0yu.png)

**AWS account name**: provide a friendly name for your new AWS account. Ex: `new-dev`

**Email address of the account's owner**: Provide a new email 
email address. Ex: email@gmail.com 
Or Provide the same email address by adding `+1` `+2` ... before `@` of your email address. Ex: `email+1@gmail.com` 

**IAM role name**: This role can be used to switch role from your root account to member accounts. Ex: `OrganizationAccountAccessRole`

Then click the `Create AWS account` button.

![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/eit7rlc9tsv6ewu1khfo.png)
 
You have successfully create a AWS account for our organization. You can create as manay account as you want for your organization.


## Model your organizational hierarchy
You can manage your organizationl hierarchy by grouping your AWS accounts in OUs(Organizational Unite)

![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/o1m7ju74l2d6r66qh1uy.png)
 
- One account should be under root or one OU.
- One OU should be under root or one OU.
- One OU can have multiple accouts and also multiple OUs.
- You can create policy (SCP) for an account or an OU or for Both.

**How to create OU(Organizational Unit)**:
Just like a folder creation, click on Root or where you want to create new OU and then from `Actions` Select `Create new`.

![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/qdbvjshk9lbml741vsjx.png)

Provide a OU name and click `Create organizational unit` button.

![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/o9u7nxxif4kz3kme4bmc.png)
 

It will successfully crating your OU. 

![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/8tm2apyocwqgc0h000e2.png)
 

> Note: You can create as many OU as you like. But only 5 depth hierarchy is allowed from the root. 
 
**How To move account to OU(Organizational Unite)**:
Just select the accounts and from the `Actions` select Move

![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/ssg6l1e3isbx61ijwxky.png)

Then select which OU you want to move the account then click `Move AWS account`.

![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/u5yxi7qk9647o1epyn55.png)

It will immediately move your account to the selected OU(Organizational Unite). You can move multiple accounts at a time.

You got the idea. You can `rename` and `delete` of your OU by following the same method.

That's how you can organize your Organizational hierarchy.
 
**Organization Services**: You can enable services for your organization. It will help you to enable services from one place to all of your member account and also you will get the centralized log. It will help you to manage multiple AWS account to one place.

![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/sra6okfpl6v0ewycrakq.png)
 
Note: To get benified by using organization try to use those organization services. Try to enable service as per your business requirements.

**Organization Policies**: Organization policies help you to enable central administration over the permissions available within the accounts in your organization. 
![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/fl9s1n51lriwwl66m4k4.png)

> Follow this to learn more & enable [Service Control Policy (SCP)](https://dev.to/noyonict/control-your-organizations-permission-using-service-control-policy-scp-3bkd) 

Note: To get benified by using organization try to use those organization Policies. Try to enable service as per your business requirements.


## Remove AWS account from Organization
You can remove AWS account from two places:

**Management account**: Just need to select AWS accont(s) which you want to remove from this Organization, then select from `Actions` `Remove from organization`

![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/5uc5kq0chdonboynos03.png)

then click `Remove account`. It will remove that AWS account from your Organization. 

> It might ask you some extra billing information for the removed account.

**Member Account**: Login to your member account which account you want to remove from organization.
go to the `AWS Organizations` console. From dashboard click `Leave this Organization`. 

![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/jqvq2qek6avp36vqg83e.png)
 
It will remove this Account from the Organization.

> Note: If you leave the organization, you become responsible for all billing charges related to this account. So AWS might ask some billing details from you. 

> If you want to rejoin the organization you have to follow the Invitation step again.


## Delete Organization
Note: You have to remove all member account first before deleting Organization.

![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/se86ycm2bezmk846uo52.png)

From the Settings click `Delete organization` button. It will delete the organization.
 
 

## Summary
AWS Organizations helps you centrally manage and govern your environment as you grow and scale your AWS resources. Using AWS Organizations, you can programmatically create new AWS accounts and allocate resources, group accounts to organize your workflows, apply policies to accounts or groups for governance, and simplify billing by using a single payment method for all of your accounts.

In addition, AWS Organizations is integrated with other AWS services so you can define central configurations, security mechanisms, audit requirements, and resource sharing across accounts in your organization. And also AWS Organisaztion is free for all.

To learn more, read the [AWS Organizations documentation](https://docs.aws.amazon.com/organizations/latest/userguide/orgs_introduction.html).

Thanks for reading! Happy Cloud Computing!

Connect with me: [Linkedin](https://www.linkedin.com/in/noyonict/)