Lesson 04 — Organizational Units (OUs)

Learning Path

☁️ Phase 2 – AWS Cloud Security

📘 Module 03 – AWS Organizations & Multi-Account Security

🎯 Lesson Objective

By the end of this lesson, you will be able to:

Understand Organizational Units (OUs).
Organize AWS accounts using OUs.
Design a scalable AWS Organization.
Understand how governance is applied at the OU level.
Recommend an enterprise OU structure.

📚 Lesson Information

Estimated Time: 60 Minutes

Difficulty: Beginner

Prerequisites: Lesson 03 – AWS Organizations Fundamentals

Hands-on Lab: No

Assignment: No

💼 Business Value

As enterprises grow, simply having multiple AWS accounts is no longer enough.

An organization with:

20 AWS Accounts
100 AWS Accounts
500 AWS Accounts

needs a logical way to group accounts based on business function, environment or security requirements.

AWS Organizational Units (OUs) solve this problem by allowing enterprises to organize AWS accounts into manageable groups.

🏢 In the Company

CloudNova Technologies now operates more than 30 AWS accounts.

Initially, all accounts were placed directly under the Management Account.

As more applications were deployed, administrators struggled to:

Apply governance consistently.
Locate accounts.
Separate production from development.
Manage different business units.

The Cloud Architecture Team introduced Organizational Units to organize AWS accounts based on their purpose.

🌍 What is an Organizational Unit?

An Organizational Unit (OU) is a logical container within AWS Organizations that groups AWS accounts with similar business or operational requirements.

Instead of managing each account individually, administrators can organize accounts into meaningful groups.

Think of an OU as a folder that contains related AWS accounts.

📁 Enterprise Example

CloudNova organizes its AWS accounts as follows:

CloudNova Organization

Management Account

│

├── Infrastructure OU
│   ├── Networking
│   ├── Shared Services
│   ├── Security
│   └── Log Archive
│
├── Workloads OU
│   ├── Development
│   ├── Testing
│   ├── Staging
│   └── Production
│
└── Sandbox OU
    ├── Student Lab
    ├── Innovation
    └── Research

This structure makes it easier to manage governance as the organization grows.

🎯 Why Use Organizational Units?

Organizational Units provide several advantages.

Group similar AWS accounts.
Simplify administration.
Apply governance consistently.
Improve visibility.
Support business growth.
Separate environments.
Reduce management complexity.

🏗 Common OU Design

Many enterprises organize accounts into the following OUs.

Organizational Unit	Purpose
Infrastructure	Shared enterprise services
Workloads	Business applications
Security	Security operations and monitoring
Sandbox	Learning and experimentation
Suspended	Accounts pending closure or decommissioning

The exact structure depends on business requirements.

🏢 CloudNova OU Design

CloudNova adopts the following design.

OU	Accounts
Infrastructure	Networking, Shared Services, CI/CD
Security	Security Operations, Log Archive
Workloads	Development, Testing, Staging, Production
Sandbox	Labs, Innovation, Proof of Concepts

This design keeps related accounts together while simplifying governance.

🔒 Governance with OUs

OUs provide a central location for governance.

Instead of configuring each AWS account separately, administrators can manage related accounts together.

Examples include:

Security guardrails
Compliance requirements
Operational standards
Account organization

In the next lesson, you will learn how Service Control Policies (SCPs) are applied to Organizational Units.

🌎 Real Enterprise Example

CloudNova launches a new Digital Banking platform.

Instead of creating a completely new AWS Organization, the Cloud Team creates:

Workloads OU

↓

Digital Banking Production

Digital Banking Testing

Digital Banking Development

This keeps all banking workloads together while following the existing enterprise governance model.

🚫 Common Mistakes

Avoid:

❌ Creating too many Organizational Units.

❌ Organizing accounts randomly.

❌ Mixing production and sandbox accounts.

❌ Naming OUs inconsistently.

❌ Creating separate AWS Organizations when an OU is sufficient.

✅ Enterprise Best Practices

Organize accounts based on business purpose.
Keep the OU structure simple.
Separate production workloads.
Use consistent naming conventions.
Review the OU hierarchy regularly.
Plan for future business growth.
Document the enterprise account structure.

🧪 Enterprise Mission 01 — Review Existing Organization

Navigate to:

AWS Console

↓

AWS Organizations

Review:

Root
Existing Organizational Units
AWS Accounts

Identify how the organization is currently structured.

🧪 Enterprise Mission 02 — Design CloudNova Organizational Units

Create Organizational Units for:

Infrastructure
Security
Workloads
Sandbox

Assign the following accounts:

Networking
Shared Services
Security
Log Archive
Development
Testing
Staging
Production
Innovation

Explain why each account belongs to its assigned OU.

🧪 Enterprise Mission 03 — Business Expansion

CloudNova acquires a new Artificial Intelligence division.

Create an updated OU structure that supports:

AI Development
AI Testing
AI Production
AI Research

Decide whether these accounts belong in an existing OU or require a new OU.

Justify your design.

🧪 Enterprise Mission 04 — Enterprise Design Exercise

CloudNova now operates:

120 AWS Accounts
15 Business Units
Multiple Global Regions

Design an Organizational Unit hierarchy that can support future growth while remaining easy to manage.

Keep the structure simple and scalable.

🏢 Enterprise Scenario

The CIO asks:

“Our company is expected to double in size over the next three years. How should we organize our AWS accounts today so we don’t need to redesign everything later?”

Prepare a recommendation covering:

Organizational Units
Future scalability
Governance
Operational simplicity

📊 Knowledge Check

What is an Organizational Unit (OU)?
Why do enterprises use Organizational Units?
Can an OU contain multiple AWS accounts?
Why should production accounts be separated from sandbox accounts?
What are the benefits of grouping accounts by business function?
Which AWS service provides Organizational Units?
Why should OU structures remain simple?
What is the relationship between OUs and governance?
Should every application have its own Organizational Unit?
How do Organizational Units improve enterprise cloud management?

📋 Lesson Completion Checklist

Task	Status
Understood Organizational Units	☐
Reviewed CloudNova OU structure	☐
Designed an enterprise hierarchy	☐
Completed business expansion exercise	☐
Reviewed enterprise scenario	☐

💡 Key Takeaways

After completing this lesson, you should understand:

Organizational Units (OUs) logically group AWS accounts within an AWS Organization.
OUs simplify administration and support enterprise growth.
A well-designed OU structure improves governance, visibility and operational efficiency.
Related AWS accounts should be grouped by business function, environment or operational purpose.
Organizational Units provide the foundation for applying governance consistently across multiple AWS accounts.

🚀 Next Lesson

➡️ Lesson 05 — Service Control Policies (SCPs)