AWS recommends a multi-account architecture as part of the AWS Well-Architected Framework and modern cloud governance practices.
On Day 4, we will prepare the AWS environment for long-term scalability by setting up:
- AWS Organizations
- Organizational Units (OUs)
- Separate development and production accounts
- Centralized access management with IAM Identity Center
This setup creates a cleaner and safer foundation for infrastructure, CI/CD pipelines, monitoring, billing control, and future team growth.
Step 1 — Verify AWS Organizations is Enabled
First, open:
AWS Console → AWS Organizations
If AWS Organizations is not enabled yet, activate it.
You should also verify that your current AWS account is acting as the Management Account.
The management account becomes the central control point for:
- account creation
- organization policies
- consolidated billing
- IAM Identity Center integration
- cross-account governance
This account should be carefully protected because it has administrative control over the entire AWS organization.
Step 2 — Create Organizational Units (OUs)
Organizational Units help logically group AWS accounts.
Go to:
AWS Organizations → Root
→ Children
→ Actions
→ Organizational unit
→ Create new
Create the following OU: Workloads
Your structure will become:
Root
└── Workloads
OUs allow you to later apply:
Service Control Policies (SCPs)
security restrictions
centralized governance
account-level controls
to multiple AWS accounts at once.
Step 3 — Create AWS Accounts
Next, create separate AWS accounts for development and production environments.
Recommended accounts:
dev Development workloads
prod Production workloads
Production environments should contain only approved workloads and should follow stricter security and access policies.
Separating these environments significantly reduces operational risk.
Step 4 — Assign Accounts to the Workloads OU
After creating the accounts, move them under the Workloads OU.
Move:
etg-dev
etg-prod
This provides cleaner organization and allows centralized policy management later.
As your infrastructure grows, you can create additional OUs such as:
Security
Sandbox
SharedServices
Infrastructure
But for an early-stage startup, keeping the structure simple is usually the best approach.
Step 5 — Configure IAM Identity Center Access
Now configure centralized access using AWS IAM Identity Center.
Instead of creating IAM users separately inside each AWS account, AWS recommends centralized authentication and permission management through IAM Identity Center.
Assign appropriate Permission Sets to users for dev and prod:
AdministratorAccess
PowerUserAccess
ReadOnlyAccess
This approach provides:
- centralized authentication
- simplified user management
- easier onboarding/offboarding
- improved security visibility
- cleaner cross-account access
It also prepares the organization for future integrations with:
external identity providers
SSO systems
enterprise access policies
Step 6 — Verify Cross-Account Access
Finally, test the complete setup.
Verify:
- IAM Identity Center login works correctly
- users can switch between accounts
- appropriate permissions are applied
- development and production accounts are accessible separately
At this point, your AWS organization is ready for scalable infrastructure management.