The Multi-Account Foundation

The organization as the security boundary: Organizations structure, trusted access and delegated administrators, Control Tower landing zones and the three kinds of control, SCPs and the newer RCPs, and root credentials at organization scale.

Content current as of 2026-10.

Lessons

1. AWS Organizations
2. Control Tower and controls
3. SCPs, RCPs, and declarative policies
4. Centrally managing security services
5. Root credentials and break-glass

Sources

• SCS-C03 exam guide — Content Domain 6 (tasks 6.1–6.3)
• AWS Organizations user guide
• AWS Control Tower user guide — controls reference
• Organizations — service control policies and resource control policies
• IAM — centralized root access for member accounts