An enterprise wants separate AWS accounts per environment (dev/staging/prod) and per business unit, with centrally enforced guardrails and shared logging. Which approach provides scalable multi-account governance?
A.One large account with IAM groups per team
Single-account boundaries can't isolate blast radius or billing per unit effectively.
B.AWS Organizations with OUs and service control policies
Correct. OUs + SCPs are the canonical multi-account guardrail pattern.
C.Separate AWS accounts billed independently
Independent billing loses consolidated visibility and governance.
D.VPC peering between team VPCs in one account
Peering is connectivity, not account governance.
Why this answer
AWS Organizations organizes accounts into organizational units (OUs) and applies service control policies as preventive guardrails across them — the standard multi-account governance model, typically bootstrapped with Control Tower.
Correct answer: B · Last reviewed 2026-10-26
Official AWS references
Practice this interactively
Answer without seeing the solution first in the Multi-Account Architecture practice session.
Practice Multi-Account Architecture