Multi-Account Governance and Compliance

Inside a single AWS account, the account administrator is the top of the tree, and anything you write there they can rewrite. That is fine until the security team asks for a promise that holds across 40 accounts. This topic covers the 4 services that make such promises possible: guardrails that sit above the account, a single sign-in that reaches every account, AWS's own list of what is already wrong, and continuous evidence that the configuration matches your requirements.

What This Topic Covers

• The structure of an AWS organization: roots, organizational units, the management account, and delegated administrators
• Service control policies as a permission ceiling, including the inheritance rules for Allow and Deny and the role of the FullAWSAccess policy
• Resource control policies for restricting what can be done to your resources by callers inside or outside the organization
• IAM Identity Center instance types, identity sources, permission sets, assignments, session durations, and attribute-based access control
• Reading and remediating Trusted Advisor security checks, including which checks a Basic Support account receives and how refresh behavior affects results
• Automating responses with EventBridge and Systems Manager Automation, plus organizational view and Trusted Advisor Priority
• AWS Config configuration items, recorders, rule triggers and evaluation modes, and automatic remediation
• Conformance packs, organization Config rules, and multi-account multi-Region aggregators

Why It Matters

The SOA-C03 exam guide names AWS Organizations, service control policies, IAM Identity Center, Trusted Advisor remediation, and AWS Config conformance packs directly in Domain 4, and questions here are rarely definitional. They give you a denied API call with a working IAM policy, or a compliance requirement several services could partly satisfy, and ask which one fits.

On the job the payoff is different. Every control in this topic is written once and applied everywhere, which is the only way governance keeps up with an account count that grows faster than the security team. The habit these lessons build is asking a single question of any control: does it have to survive a local administrator? The answer decides whether it belongs in an SCP above the account or an IAM policy inside it.