Lab: Automating Multi-Account Governance and Account Provisioning

This hands-on lab guides you through the process of automating the creation, onboarding, and securing of AWS accounts within a multi-account environment. You will leverage AWS Organizations, AWS Control Tower concepts, and AWS Config for centralized governance.

[!WARNING] Remember to run the teardown commands at the end of this lab to avoid ongoing charges. Estimated cost is minimal if resources are deleted immediately.

Prerequisites

To successfully complete this lab, you need:

An AWS Management Account (Root access or Administrator permissions).
AWS CLI installed and configured with credentials for the Management Account.
Basic knowledge of JSON and CloudFormation.
IAM User/Role with permissions to organizations:*, controltower:*, and config:*.

Learning Objectives

By the end of this lab, you will be able to:

Automate AWS account creation using the AWS CLI.
Implement a centralized AWS Config Aggregator for multi-account/multi-Region visibility.
Deploy governance controls using Service Control Policies (SCPs).
Understand the workflow of the AWS Control Tower Account Factory.

Architecture Overview

This architecture demonstrates a management account controlling the lifecycle of member accounts, with centralized compliance data flowing back to a single dashboard.

Loading Diagram...

Figure 1 — Mermaid diagram

Compiling TikZ diagram…

⏳

Running TeX engine…

This may take a few seconds

Figure 2 — TikZ diagram

Step-by-Step Instructions

Step 1: Verify Organizations and Create a New Account

We will use the AWS CLI to programmatically create a new member account within your organization.

bash

# Verify you are in an organization
aws organizations describe-organization

# Create a new account (Replace email with a unique address)
aws organizations create-account \
    --email "brainybee-lab-member-1@example.com" \
    --account-name "BrainyBee-Lab-Member"

[!NOTE] Account creation is asynchronous. Note the CreateAccountRequestId from the output to check status.

▶Console alternative

Navigate to AWS Organizations > Add an AWS account > Create an AWS account. Fill in the name and email, then click Create AWS account.

Step 2: Check Account Creation Status

bash

# Replace <RequestId> with your ID from Step 1
aws organizations describe-create-account-status --create-account-request-id <RequestId>

Step 3: Set up a Multi-Account Config Aggregator

Centralizing compliance data is critical for multi-account environments. We will create an aggregator in the Management account.

bash

# Authorize the aggregator to collect data from the organization
aws configservice put-configuration-aggregator \
    --configuration-aggregator-name "brainybee-global-aggregator" \
    --organization-aggregation-source "{\"RoleArn\": \"arn:aws:iam::<YOUR_ACCOUNT_ID>:role/aws-service-role/config-tester.amazonaws.com/AWSServiceRoleForConfig\", \"AllRegions\": true}"

▶Console alternative

Navigate to AWS Config > Aggregators > Create aggregator. Select "Allow data replication", choose "My organization", and select all regions.

Step 4: Apply an SCP to Restrict Regions

Secure the new account by preventing it from launching resources in unauthorized regions.

bash

# 1. Create the SCP policy file (policy.json)
cat <<EOF > region-lock.json
{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Sid": "DenyAllOutsideUsEast1",
            "Effect": "Deny",
            "NotAction": "*",
            "Resource": "*",
            "Condition": {
                "StringNotEquals": {"aws:RequestedRegion": ["us-east-1"]}
            }
        }
    ]
}
EOF

# 2. Create the policy in Organizations
aws organizations create-policy \
    --content file://region-lock.json \
    --description "Restrict to us-east-1" \
    --name "RegionLockPolicy" \
    --type SERVICE_CONTROL_POLICY

Checkpoints

Account Creation: Run aws organizations list-accounts. Does your new member account appear with a STATUS of ACTIVE?
Policy Attachment: Check the Organizations console. Is the RegionLockPolicy attached to the Root or the specific member account?
Aggregation: In the Config console, under Aggregators, do you see the name brainybee-global-aggregator?

Clean-Up / Teardown

[!IMPORTANT] Member accounts created via Organizations cannot be deleted via CLI; they must be closed via the Console or have a payment method added to be "unlinked".

Delete Config Aggregator:
bash
aws configservice delete-configuration-aggregator --configuration-aggregator-name "brainybee-global-aggregator"
Delete SCP:
bash
# Replace <PolicyId> with the ID from Step 4 aws organizations delete-policy --policy-id <PolicyId>
Close Member Account: Navigate to AWS Organizations in the Console, select the account, and click Close account.

Troubleshooting

Error	Cause	Fix
`Finalizing account...`	Account creation takes 1-3 minutes.	Wait and poll `describe-create-account-status`.
`AccessDenied`	Missing IAM permissions for Organizations.	Ensure your user has `AdministratorAccess` or specific Org permissions.
`ConstraintViolationException`	Organization not initialized.	Run `aws organizations create-organization` first.

Stretch Challenge

Task: Use AWS CloudFormation StackSets to deploy an IAM Role into the newly created member account from the management account. This role should allow your central security team to audit the member account.

▶Hint

Use aws cloudformation create-stack-set with the parameter TemplateURL pointing to a local audit-role.yaml file, then use create-stack-instances targeting your new Account ID.

Cost Estimate

Service	Cost Component	Estimated (30m Lab)
AWS Organizations	Service Fee	$0.00
AWS Config	Configuration Item recorded	~$0.003 / item
AWS Control Tower	Landing Zone	$0.00 (But underlying Config rules apply)
Total		<$0.50 USD

Concept Review

Tool	Primary Purpose	Key Feature
AWS Organizations	Account Management	Hierarchical OUs and SCPs
AWS Control Tower	Governance at Scale	Automated Landing Zone and Guardrails
AWS Config	Compliance Tracking	Multi-account data aggregation
CloudFormation StackSets	Provisioning	Multi-region resource deployment

Lab: Automating Multi-Account Governance and Account Provisioning

[!WARNING] Remember to run the teardown commands at the end of this lab to avoid ongoing charges. Estimated cost is minimal if resources are deleted immediately.

Prerequisites

To successfully complete this lab, you need:

An AWS Management Account (Root access or Administrator permissions).
AWS CLI installed and configured with credentials for the Management Account.
Basic knowledge of JSON and CloudFormation.
IAM User/Role with permissions to organizations:*, controltower:*, and config:*.

Learning Objectives

By the end of this lab, you will be able to:

Automate AWS account creation using the AWS CLI.
Implement a centralized AWS Config Aggregator for multi-account/multi-Region visibility.
Deploy governance controls using Service Control Policies (SCPs).
Understand the workflow of the AWS Control Tower Account Factory.

Architecture Overview

This architecture demonstrates a management account controlling the lifecycle of member accounts, with centralized compliance data flowing back to a single dashboard.

Loading Diagram...

Figure 1 — Mermaid diagram

Compiling TikZ diagram…

⏳

Running TeX engine…

This may take a few seconds

Figure 2 — TikZ diagram

Step-by-Step Instructions

Step 1: Verify Organizations and Create a New Account

We will use the AWS CLI to programmatically create a new member account within your organization.

bash

# Verify you are in an organization
aws organizations describe-organization

# Create a new account (Replace email with a unique address)
aws organizations create-account \
    --email "brainybee-lab-member-1@example.com" \
    --account-name "BrainyBee-Lab-Member"

[!NOTE] Account creation is asynchronous. Note the CreateAccountRequestId from the output to check status.

▶Console alternative

Navigate to AWS Organizations > Add an AWS account > Create an AWS account. Fill in the name and email, then click Create AWS account.

Step 2: Check Account Creation Status

bash

# Replace <RequestId> with your ID from Step 1
aws organizations describe-create-account-status --create-account-request-id <RequestId>

Step 3: Set up a Multi-Account Config Aggregator

Centralizing compliance data is critical for multi-account environments. We will create an aggregator in the Management account.

bash

# Authorize the aggregator to collect data from the organization
aws configservice put-configuration-aggregator \
    --configuration-aggregator-name "brainybee-global-aggregator" \
    --organization-aggregation-source "{\"RoleArn\": \"arn:aws:iam::<YOUR_ACCOUNT_ID>:role/aws-service-role/config-tester.amazonaws.com/AWSServiceRoleForConfig\", \"AllRegions\": true}"

▶Console alternative

Navigate to AWS Config > Aggregators > Create aggregator. Select "Allow data replication", choose "My organization", and select all regions.

Step 4: Apply an SCP to Restrict Regions

Secure the new account by preventing it from launching resources in unauthorized regions.

bash

# 1. Create the SCP policy file (policy.json)
cat <<EOF > region-lock.json
{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Sid": "DenyAllOutsideUsEast1",
            "Effect": "Deny",
            "NotAction": "*",
            "Resource": "*",
            "Condition": {
                "StringNotEquals": {"aws:RequestedRegion": ["us-east-1"]}
            }
        }
    ]
}
EOF

# 2. Create the policy in Organizations
aws organizations create-policy \
    --content file://region-lock.json \
    --description "Restrict to us-east-1" \
    --name "RegionLockPolicy" \
    --type SERVICE_CONTROL_POLICY

Checkpoints

Account Creation: Run aws organizations list-accounts. Does your new member account appear with a STATUS of ACTIVE?
Policy Attachment: Check the Organizations console. Is the RegionLockPolicy attached to the Root or the specific member account?
Aggregation: In the Config console, under Aggregators, do you see the name brainybee-global-aggregator?

Clean-Up / Teardown

[!IMPORTANT] Member accounts created via Organizations cannot be deleted via CLI; they must be closed via the Console or have a payment method added to be "unlinked".

Delete Config Aggregator:
bash
aws configservice delete-configuration-aggregator --configuration-aggregator-name "brainybee-global-aggregator"
Delete SCP:
bash
# Replace <PolicyId> with the ID from Step 4 aws organizations delete-policy --policy-id <PolicyId>
Close Member Account: Navigate to AWS Organizations in the Console, select the account, and click Close account.

Troubleshooting

Error	Cause	Fix
`Finalizing account...`	Account creation takes 1-3 minutes.	Wait and poll `describe-create-account-status`.
`AccessDenied`	Missing IAM permissions for Organizations.	Ensure your user has `AdministratorAccess` or specific Org permissions.
`ConstraintViolationException`	Organization not initialized.	Run `aws organizations create-organization` first.

Stretch Challenge

▶Hint

Use aws cloudformation create-stack-set with the parameter TemplateURL pointing to a local audit-role.yaml file, then use create-stack-instances targeting your new Account ID.

Cost Estimate

Service	Cost Component	Estimated (30m Lab)
AWS Organizations	Service Fee	$0.00
AWS Config	Configuration Item recorded	~$0.003 / item
AWS Control Tower	Landing Zone	$0.00 (But underlying Config rules apply)
Total		<$0.50 USD

Concept Review

Tool	Primary Purpose	Key Feature
AWS Organizations	Account Management	Hierarchical OUs and SCPs
AWS Control Tower	Governance at Scale	Automated Landing Zone and Guardrails
AWS Config	Compliance Tracking	Multi-account data aggregation
CloudFormation StackSets	Provisioning	Multi-region resource deployment