AWS Overview
An overview of AWS's architecture
Last updated
An overview of AWS's architecture
This page provides a high-level overview of core AWS services from a security perspective. These services are key to building comprehensive security coverage across your environment, but this list is not exhaustive.
AWS Organization
└── Organizational Units (optional)
└── Account(s)
└── Resource(s)AWS Organizations is a feature that can be optionally enabled to provide organizational and security governance across multiple AWS accounts. The account where this gets enabled is called the Management account (aka Payer account). Accounts can be placed under the root of the Organization or can optionally be placed into Organizational Units (OUs). OUs provide logical organization of accounts and can be leveraged for Service Control Policies (SCPs) as a preventive control, tag policies for governance enforcement, and more.
Enabling Organizations provides features such as:
Consolidated billing of all AWS accounts in the Organization
Organizational security and governance policies
AWS accounts are the primary unit of security isolation. Each account has its own Identity and Access Management (IAM), independent resource spaces, and separate network boundaries. This makes accounts the recommended blast radius boundary; a compromise or misconfiguration in one account does not directly affect others. This is the foundation of the AWS multi-account strategy, where workloads, environments (dev/prod), and security functions (logging, auditing) are separated into dedicated accounts.
The management account is exempt from SCPs and cannot be restricted by organizational policies. A compromise of the management account is effectively a compromise of the entire organization. AWS recommends several best practices such as minimizing access to this account and using Delegated Administrator to shift organizational feature management, such as Security Hub or GuardDuty administration, to member accounts that can be governed by SCPs and other organizational policies.
Last updated