Practical steps using AWS Organization
Tags: aws, cloud, compliance
Published: 2022-06-29 16:01:10

Scenario where you have to manage several accounts in your company being the Cloud Administrator.


![AWS architecture diagram](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/0ehxnewspim04y4a3yc9.png)
AWS Organization offers solution to the pain-point with several advantages;

- AWS Organizations helps you centrally manage and govern your environment as you grow and scale your AWS resources.

- Using AWS Organizations, you can create accounts and allocate resources, group accounts to organize your workflows.

- Apply policies for governance using SCP(Service Control Policy)

- Simplify billing by using a single payment method for all of your accounts(consolidated billing)

It consists of two entities:

1. Management/Master account: The management account creates the organization.
2. Member account: these are accounts which are invited by the management account.

## Steps in creating an AWS Organization

- Click to the [AWS console](https://aws.amazon.com/console/)

- Login to you accounts with your IAM credentials 
- Search for the **aws organization** on the search bar
![homepage](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/kxtz4idm5lay9s6cycwm.png)

- Click on the AWS Organization title indicate above 

- Click the **Create Organization** on the home page 

- After creating an organization, invitation can be send to member account either existing account or a new account

![Add AWS account](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/0x3spqzenhe4gpel1yse.png)
 

- An existing account can be invited using account ID or email
![existing AWS account](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/3n2f7yzteq6zigvusveg.png)
 

- A new account can be invited using **email only**
![new AWS account](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/myyqnqtx1y2nnb8t4qhs.png)

- when you create a new account the role is **automatically given**, BUT adding an existing account requires to **manually create the role**

- Grant **OrganizationAccountAccessRole** to the master account from the member account IAM for trusted entity and permission.

- Go to the **IAM** service, Click on *role*, then create the trusted entity
![Trust entity](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/c4sxz54xlx50lee9qxb0.png)

- The account ID of the master account is given as a trusted entity for this role.
![Master account](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/546877g54yj3fhufyanx.png)
 
- Also, assign the AWS Managed permission **AdministratorAccess** to the role
![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/mbhhvofb6bk1whl6whpe.png)

- Ensure that the role name is **OrganizationAccountAccessRole** , add description based on your preference
**OrganizationAccountAccessRole** and click the create icon.

- For an existing AWS account, the admin needs to accept the invitation sent by the master account to join the organization.

- Proceed to Master account and switch role
![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/g2wvj5d4avwz44r3lu0x.png)

- Login into the member accounts with the credentials created earlier.
![Switch role 1](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/f95e7tobzzowv0inox4f.png)
 
![Switch role 2](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/32s06wkzytxf48aq9yr4.png)

- After putting the correct login credentials, you will be successfully login into the member account as a **Federated user***
![login](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/wpl3mhfizbnczqo8ikev.png)

## HIERACCCHY STRUCTURE 
This enable to create the OU(Organizational Unit) within the root container of the organization. Members account can be grouped into the OU.
- In the AWS Organization Dashboard (Master Account), tick the root as specified , then click actions
![Organizational unit](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/cujeroovyxhixervp169.png)

- Create the Organizational unit to structure the member accounts
![OU deployment](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/5gczypac043lof3wslrv.png)

- Click the member account to add to OU, then click on actions to move.
![Adding account to OU 1](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/flg629dya3ntgz45pcon.png)

![Adding account to OU 2](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/5od344ubwiy2eotpve9f.png)
 
 

## USING SERVICE CONTROL POLICY(SCP).
SCP is used to perform permission across member accounts, the permission given should also be allowed in the IAM of the member accounts.
SCP basically restricts the access to AWS services prior before the IAM permission takes over.

![SCP](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/zaek3cmqxsadf9o3rocy.png)

By default, the SCP is **disabled** in the organization.


Thanks for reading!!!