In AWS Organizations, what is the primary purpose of using an organizational unit (OU) structure?

• A. To group accounts for policy application and governance, enabling SCPs and centralized controls at the OU level.
• B. To define IAM roles for individual users
• C. To manage billing for a single account
• D. To store data in S3 buckets

Answer: (A)

Grouping accounts into organizational units in AWS Organizations enables centralized governance by applying policies across multiple accounts. OU structures let you place accounts into logical folders (for example by department or environment) and attach service control policies (SCPs) at the OU level. These SCPs act as permission guardrails that restrict what actions are allowed across all member accounts, and because policies cascade down the hierarchy, you get consistent, scalable controls without configuring each account individually. It’s important to remember that SCPs limit permissions rather than grant them; the actual access is still determined by the IAM policies and roles defined inside each account.

This approach is not about defining IAM roles for individual users, managing billing for a single account, or storing data in S3 buckets, which are handled by other AWS services and configurations.