Designing Enterprise-Wide Scalable Operations
The multi-account operating model
Enterprises scale by splitting accounts along boundaries: security, log archive, shared services, network, and per-workload or per-environment accounts. AWS Organizations provides consolidated billing and policy inheritance; organizational units group accounts; service control policies cap the maximum permissions available in member accounts. Control Tower automates a landing zone with guardrails, and IAM Identity Center provides federated workforce access with permission sets rather than long-lived IAM users.
Centralize the shared services
Networking: Transit Gateway for transitive hub-and-spoke connectivity, VPC sharing through Resource Access Manager so teams launch into centrally managed subnets, IPAM for address planning, and Route 53 Resolver rules for hybrid DNS. Security and audit: an organization trail for CloudTrail, AWS Config with a central aggregator, Security Hub with delegated administration, and GuardDuty across all accounts. Standardization: CloudFormation StackSets for baseline deployment across accounts, Service Catalog for approved product templates, Systems Manager for patching and runbooks at fleet scale, and AWS Backup with organization-wide policies.
Traps
SCPs do not grant permissions; they only filter them, and they do not affect the management account or service-linked roles. Permission boundaries are for delegated administration, not for organizational guardrails. VPC peering is not transitive; Transit Gateway is the answer to full-mesh questions. StackSets with service-managed permissions can deploy to organization units and auto-deploy to new accounts, whereas self-managed permissions require manual IAM role setup. Config rules are detective, not preventive; SCPs are preventive.
Rule of thumb
Layer controls: SCPs at the OU for hard regional and service limits, permission boundaries for delegated admins, IAM policies for team-level grants, Config rules for detection, and Service Catalog for approved patterns. Preventive stops it from happening; detective tells you it happened.