Design Solutions for Organizational Complexity
Organizational complexity questions test whether you can design across many AWS accounts, teams, and business units while keeping security and billing coherent. The core building blocks are AWS Organizations, organizational units (OUs), service control policies (SCPs), consolidated billing, and cross-account access via IAM roles. Understand the difference between identity-based policies, resource-based policies, permissions boundaries, and SCPs: SCPs never grant permissions, they only set the maximum available to accounts in an OU, and they do not affect the management account or service-linked roles.
Centralized networking and access
Know the patterns for shared networking: VPC sharing through AWS Resource Access Manager, centralized egress/inspection VPCs with Transit Gateway, and centralized DNS with Route 53 Resolver rules shared across accounts. For identity, distinguish IAM Identity Center (centralized workforce SSO with permission sets) from federation into individual accounts. For governance, know AWS Control Tower guardrails, account factory, and how preventive and detective controls map to SCPs and AWS Config rules.
Traps to watch
- Assuming an SCP grants access; it only restricts.
- Forgetting that SCPs apply to the member account's principals, not to resource policies evaluated at the resource owner.
- Mixing up consolidated billing (one payer, volume discounts) with cost allocation (tagging, cost categories).
- Ignoring that a shared VPC participant account cannot modify resources it does not own.
Worked example
A company has 40 accounts under three OUs: Sandbox, Production, and Security. Production must never allow root user API keys and must block regions outside us-east-1 and eu-west-1. Attach an SCP at the Production OU denying iam:CreateAccessKey when the principal is root and denying all actions with a aws:RequestedRegion condition outside the approved list. Because SCPs are inherited, all 40 accounts in child OUs get the control without per-account IAM changes. Add an AWS Config rule for detective enforcement and a Control Tower guardrail for drift reporting. Rule of thumb: enforce with SCPs at the OU, detect with Config, and never rely on SCPs for granting access.