A company wants to manage billing and enforce permission guardrails across its 30 AWS accounts from one place. Which service provides this?
A.AWS IAM
IAM is per-account identity management, not multi-account governance.
B.AWS Organizations
Correct. Multi-account management + SCPs + consolidated billing.
C.Amazon Cognito
Cognito handles app user authentication, not account structure.
D.AWS Control Tower — but only via third-party tools
Control Tower is real but layers on top of Organizations — and isn't third-party.
Why this answer
AWS Organizations provides consolidated billing, OU-based structure, and Service Control Policies (guardrails on what accounts can do). IAM manages identities inside an account; Control Tower builds on Organizations for landing-zone automation.
Correct answer: B · Last reviewed 2026-10-27
Official AWS references
Practice this interactively
Answer without seeing the solution first in the Security Basics practice session.
Practice Security Basics