Multi-Account Governance — AWS Solutions Architect (SAA-C03)
Organizations enforce policy; Control Tower builds guardrails
The scenario describes enforcing a security baseline or restricting services across dozens of accounts. Candidates reach for IAM because they understand its permissions model. The exam is testing org-level controls: SCPs via AWS Organizations apply non-overridable permission guardrails; Control Tower automates landing zone setup and governance at scale across OUs. IAM cannot restrict an account's administrator or prevent service enablement at the account boundary. When scope is the account itself, the answer lives in Organizations or Control Tower.
What This Pattern Tests
The exam describes a multi-account environment and tests governance controls. AWS Organizations groups accounts into OUs. SCPs on OUs set maximum permission boundaries — they deny, never grant. CloudTrail organization trails aggregate audit logs. AWS Config aggregator collects compliance data across accounts. RAM (Resource Access Manager) shares resources across accounts without duplication. The trap is using SCPs to grant permissions (they only restrict) or creating cross-account IAM users instead of cross-account roles (roles use temporary credentials).
Decision Axis
Governance scope determines the tool: organization-wide restriction = SCP, account-specific permission = IAM, cross-account sharing = RAM/roles, compliance visibility = Config aggregator.
Associated Traps
Decision Rules
Whether to enforce an organization-level preventive SCP via AWS Organizations that blocks public-access actions on S3 across all member accounts — or to deploy Amazon Macie per account to detect and alert on PII exposure, a detective approach that requires per-account provisioning and can be disabled by member account admins.
Select preventive org-level guardrail (SCP via AWS Organizations) over detective or aggregation controls (Macie, Security Hub) when the stated requirement explicitly demands member accounts cannot override or disable the enforcement mechanism.
Whether to apply a minimum-sufficient org-level preventive guardrail (SCP plus S3 Block Public Access at the organization level) versus deploying per-account detective controls such as Amazon Macie that exceed the stated requirement, add per-account scan costs, and cannot guarantee prevention.
Domain Coverage
Difficulty Breakdown