2.2.2.3. Centralized Account Management (Organizations, Control Tower)

2.2.2.3. Centralized Account Management (Organizations, Control Tower, Trusted Advisor)

Centralized management means governing 100+ accounts without logging into each one.

AWS Organizations features for the exam:

• Consolidated billing: Single payment, volume discounts, Reserved Instance sharing
• SCPs: Organizational-level permission boundaries
• Tag policies: Enforce consistent tagging (e.g., Environment must be dev|staging|prod)
• Backup policies: Enforce AWS Backup plans across accounts
• AI services opt-out policies: Control data use for AI improvement

Control Tower guardrails:

AWS Trusted Advisor provides account-level recommendations: cost optimization, performance, security, fault tolerance, and service limits. Full features require Business or Enterprise Support.

Exam Trap: By default, Organizations tag policies only report non-compliant tag values — the resource is still created. Enforcement (enforced_for) blocks non-compliant tagging operations only on the resource types you list, and it checks tag values, not presence: untagged resources aren't evaluated. Required tag keys (report_required_tag_for) are checked only in IaC deployments, e.g. by the AWS::TagPolicies::TaggingComplianceValidator CloudFormation hook. To prevent resource creation without required tags, use an SCP:

{
  "Effect": "Deny",
  "Action": "ec2:RunInstances",
  "Resource": "*",
  "Condition": {
    "Null": {"aws:RequestTag/Environment": "true"}
  }
}