Organizations

Question 1

What is AWS Organizations?

Answer 1

AWS Organizations helps you configure AWS services and share resources across accounts in your organization. For example, Organizations integrates with AWS Single Sign-on to enable you to easily provision access for all of your developers to accounts in your organization from a single place.

Question 2

What type of accounts are present in an AWS Organization?

Answer 2

the master account, you can not change it and the remaining accounts are member account

Question 3

How many AWS Organizations can a Member Account belong to?

Answer 3

Member accounts can only be part of one organization

Question 4

What are some AWS organizations benefits?

Answer 4

Pricing from aggregated usage (volume discount for EC2, S3)
Consolidated Billing accross all accounts
API is available to automate account creation

Question 5

What are Organizational Units?

Answer 5

You can use organizational units (OUs) to group accounts together to administer as a single unit.
OUs can contain other OUs as well.

Question 6

What are Service Control Policies?

Answer 6

Service control policies (SCPs) are a type of organization policy that you can use to manage permissions in your organization. SCPs offer central control over the maximum available permissions for all accounts in your organization

Question 7

What can you do with IAM using Organizations’ SCPs?

Answer 7

Whitelist or blacklist IAM actions

Question 8

At what level can you apply Service Control Policies (SCP)?

Answer 8

at the OU or account level

Question 9

To what you can’t apply a SCP?

Answer 9

to the master account

Question 10

What is the default permissions in SCP?

Answer 10

SCP must have an explicit Allow (does not allow anything by default)

Question 11

What is the precedence stablished for SCPs?

Answer 11

deny over authorize.

if you say OU X can’t read and you say an OU X account member can read, the result will be the account member can’r read

Question 12

What are the steps to migrate accounts from one organization to another?

Answer 12

1. Remove the member account from the old organization
2. Send an invite to the new organization
3. Accept the invite to the new organization from the
   member account

Question 13

What are the steps if you want the master account of the old organization to
also join the new organization?

Answer 13

1. Migrate the member accounts from the organizations
2. Delete the old organization
3. Repeat the process above