Introduction

As enterprises grow their AWS usage, they often maintain multiple organizations with AWS Organizations. Enterprises might create and maintain these organizations in AWS Organizations through mergers, acquisitions, or expansion. Although this setup works initially, organizations might encounter higher costs, complicated management, and inconsistent security across hundreds of accounts over time.

This article shows you how to consolidate your multiple organizations into one unified structure. We will walk through a proven four-phase approach that TAMs at AWS use to help enterprise customers. With this approach, you can reduce complexity, cut costs, and improve governance without disrupting your business operations. For complex consolidations, you can leverage AWS Countdown or AWS Countdown Premium to coordinate teams and manage milestones, with AWS Enterprise Support providing seamless implementation across all phases.

Challenges

• Financial impact: Having multiple organizations prevents you from taking advantage of volume discount optimization. This is because this setup limits Savings Plans and Reserved Instance (RI) sharing benefits across your AWS environment.

• Operational complexity: Managing separate organizational policies and governance frameworks increases your administrative overhead and complicates resource sharing.

• Security and compliance: Having multiple organizations makes it difficult to maintain consistent security protocols and generate consolidated compliance reports.

Prerequisites

You can successfully consolidate your organizations through careful preparation. Before you migrate your AWS account from one organization to another, make sure that you complete all the required steps. For more information, see Migrate an account to another organization with AWS Organizations.

Complete the following critical prerequisites for all accounts in your source organization:

• Reactivate or remove any suspended accounts from your organization before migration.

• Freeze new account creation during migration. To migrate a new account, you must wait at least 4 days after you create the account.

• Make sure that each account that you're migrating has a valid payment method configured. Accounts can't rely on the organization's consolidated billing payment method after you remove them from the source organization.

• If you're an Enterprise customer that uses invoicing, then you can configure the payment methods in bulk through concierge access along with phone verification. To do so, submit a request from the management account in your source organization through a support case for guidance on next steps. If you use credit card payments, then you must add the payment method to each account individually.

You can also complete the following prerequisites for optimal results:

• Run the Account Assessment for AWS Organizations solution on all of your organizations.

• Identify accounts with complex service configurations that require special handling, such as the following:

  • Accounts that serve as delegated administrators for AWS services

  • Accounts with cross-account resource sharing through AWS Resource Access Manager (RAM).

  • Accounts that host shared services, such as AWS Transit Gateway or AWS Direct Connect

  • Accounts with custom AWS Identity and Access Management (IAM) identity providers or complex cross-account trust relationships

  • Accounts where AWS services have trusted access turned on in both source and target organizations

Important considerations and limitations

Before you proceed with consolidation, review these limitations and potential challenges:

• Removing AWS Firewall Manager delegated administrator status during consolidation automatically deletes all existing policies from source organizations. Use the AWS CLI to export existing policies before consolidation, and then use automation to create the policies again in your target organization. This process helps you validate proper functionality in the new environment.

• Your accounts might experience brief interruptions to RIs and Savings Plan benefits during the transition. Use automated migration scripts to minimize the transition time.

• Cost and Usage Reports maintain one-to-one relationships with AWS Organizations. Deleting source organizations results in the permanent loss of historical data, and AWS can't backfill this information. Cost and Usage Report updates occur three times daily on a best-effort basis, and can potentially create gaps in hourly data during migration. Export necessary historical data before consolidation and establish new Cost and Usage Report configurations in your target organization.

• After migration, linked accounts lose access to historical AWS Cost Explorer data from previous organizations. Basic billing information remains available through the AWS Billing and Cost Management console. However, detailed information, such as tags and Amazon Resource Names (ARNs), aren't accessible. Export essential historical cost data to CSV files. Also, retain the existing Cost and Usage Reports in Amazon S3 buckets for historical reference.

Solution

To address the challenges of operating with multiple organizations, enterprise customers must adopt a strategic phased approach to consolidation that minimizes business disruption and optimizes cost-saving opportunities. By working closely with TAMs, your organizations can implement a comprehensive consolidation strategy that’s focused on four key phases.

Phase 1: Planning and preparation

To set up your target environment, complete the following steps:

1. Establish the management account for your consolidated organization. It's a best practice to create a dedicated standalone management account for a clean separation of billing and governance functions. For more information, see Establishing your best practice AWS environment. You can also use an existing payer account. In this case, select an existing account that has minimal workloads and appropriate security controls.

2. Establish a new organization in AWS Organizations within this account.

3. Validate tax settings and billing and payment methods.

4. Work with your account manager to make sure that any existing AWS agreements associated with your current payer accounts are associated with the new payer account.

5. Configure the sharing preferences for RIs and Savings Plan discounts in the new organization before you start the migration. This step helps provide continuous cost optimization coverage and prevents discount gaps during account transitions.

Complete your assessment and planning through these steps:

1. Create a comprehensive inventory of delegated administrators and cross-account resources.

2. Document Savings Plans and RIs by account to minimize coverage gaps.

3. Work with your Enterprise Support team to interpret the Account Assessment for Organizations results and address identified gaps.

To build a foundation for your infrastructure, complete the following steps:

1. Deploy governance and monitoring infrastructure based on your organizational needs. If you prefer standardized, automated governance, then implement AWS Control Tower to handle multi-account management, guardrails, and compliance monitoring. If you need customized governance controls, then manually configure service control policies (SCPs) and an organizational unit (OU) structure to meet your specific requirements.

2. Configure a Cost and Usage Report.

3. Establish a transitional OU that has minimal SCPs.

4. Coordinate with the concierge team in AWS to adjust your organization's service quotas, as needed, for your consolidation. To do so, submit a support case under the Account and billing category.

5. Develop a detailed migration strategy with rollback procedures.

To establish communication and coordination, follow these steps:

1. Make sure that your organization establishes a cross-functional consolidation team. Include representatives from cloud operations, security, IT, FinOps, and R&D teams to keep all relevant stakeholders involved.

2. Create an escalation matrix with contact information for technical and business stakeholders.

3. Establish dedicated communication channels, such as Slack or Microsoft Teams, for project updates and real-time coordination.

4. Develop templated communications for migration notifications, status updates, and common scenarios.

5. Define standup meeting schedules and the participant list.

6. Communicate billing implications with finance teams. For example, AWS Cost Explorer loses historical data for migrated accounts. You must create the Cost and Usage Reports again in the new organization, with historical data remaining in the original Amazon Simple Storage Service (Amazon S3) bucket. Therefore, you get two sets of invoices during migration: one pre-migration, and one post-migration.

Make sure that you make the Go/No-Go decision for migration based on whether you meet all critical prerequisites, completed assessments, and validated the target environment.

Phase 2: Testing

To pilot the account migration activities, complete the following steps:

1. Select three to five non-production accounts that represent diverse service usage patterns.

2. Run the complete migration workflow that includes removal, invitation, and OU assignment.

3. Validate account functionality, including IAM access and cross-account trust relationships, and service-specific configurations after the migration is complete. For more information, see What you need to do after migrating an account.

To perform infrastructure and access validation, follow these steps:

1. Test AWS Control Tower configurations and AWS IAM Identity Center setup.

2. Verify SCPs and permissions boundaries.

3. Validate cross-account access patterns and resource sharing configurations.

Complete process and automation testing through these steps:

1. Build and test migration automation scripts to handle account removal, invitation workflows, and error scenarios. Use samples on the GitHub website, such as aws-account-migration-example or AWS account migration solution, as a starting point for your automation framework.

2. Validate rollback procedures, including the ability to revert accounts to source organizations when migration issues occur. Check automated monitoring to detect and respond to failures.

3. Verify that your end-to-end automation workflows can handle edge cases, such as suspended accounts, payment method issues, and API rate limiting.

Success criteria include the following conditions:

• All test accounts are migrated successfully.

• There are no service disruptions.

• Automation is validated.

Throughout this phase, your TAM serves as a strategic advisor to help you interpret test results and provide you with guidance based on best practices. The insights that you gather during testing can help refine your consolidation strategy and support a smoother transition during the full-scale migration.

Phase 3: Organization consolidation

This phase requires careful orchestration to minimize business disruption. Finalize your migration schedule, and then organize accounts into cohorts based on dependencies and complexity. Confirm that you meet all prerequisites. Make sure that the automation scripts can complete migrations rapidly to minimize time outside of RI and Savings Plan coverage.

1. Before you start the migration, identify and document all delegated administrator accounts, and plan their specific sequencing within the migration process. Prepare the AWS Command Line Interface (AWS CLI) commands for exporting AWS Firewall Manager policies. Establish a process for recreating delegated administrator assignments in the target organization. The steps outlined for Firewall Manager provide a sample process. You can follow this sample process for other services that support delegated administrator functionality with AWS Organizations. If you use infrastructure as code, then make sure that your existing templates are ready for redeployment in the target organization. This preparation is crucial, because if you remove the Firewall Manager delegated administrator status during consolidation, then existing policies from your source organizations are automatically deleted.

2. Automate and complete account migration quickly. Start with non-production accounts for final validation, and then proceed with remaining accounts. The automated process removes accounts from source organizations, manages invitation workflows to the target organization, and handles accounts with delegated administrator status. Place migrated accounts into a transitional OU with minimal SCPs during transition.

3. The final step involves converting the management accounts from source organizations into member accounts of your new consolidated organization. For this process, you must create new standalone accounts to replace the management functions. Then, migrate the original management accounts as regular member accounts.

Organizations with active Savings Plans or RIs must prioritize speed of migration. Any delay in migration might lead to your accounts underutilizing Savings Plans or RIs. This can result in loss of coverage and cost optimization benefits.

Following this structured, automated approach results in efficient core consolidation while minimizing disruption to production workloads. Your TAM provides guidance throughout the process and helps you navigate complex scenarios for a successful migration. The goal is to minimize the time that accounts spend outside of your organizational structure to maintain consistent governance and maximize cost optimization benefits.

Phase 4: Post-consolidation activities

After you successfully migrate accounts to the target organization, focus on these critical post-consolidation activities for long-term operational success:

1. **Organizational structure refinement: **Move accounts from the transitional OU to their designated permanent OUs. Implement appropriate SCPs and validate access patterns and resource sharing configurations.

2. Infrastructure and security optimization: Review and optimize AWS CloudTrail configurations, and clean up temporary IAM roles. Update resource policies to reference the new organization ID, and reconfigure AWS RAM shares as needed.

3. Governance and compliance enhancement: Implement standardized account management procedures and configure centralized logging and monitoring. Update compliance reporting mechanisms to align with the new organizational structure.

4. **Cost management review: **Verify cost allocation tag implementation. Confirm Savings Plan and Reserved Instances utilization across the consolidated organization. Establish new cost reporting baselines, and evaluate whether AWS Invoice Configuration can benefit your organization's invoicing requirements. You can use invoice configuration to receive separate invoices for member accounts that belong to different business entities within your consolidated organization. These entities can include subsidiaries, cost centers, legal entities, and departments. That way, you can split charges at the business entity level, designate separate invoice receivers, and align your unique FinOps processes across different business units.

5. Operational procedures update: Work with your TAM to develop new operational procedures that use the benefits of your consolidated organization structure, including documentation of the new organizational hierarchy and access to historical billing data.

Benefits

Consolidating multiple AWS Organizations delivers measurable improvements across three key areas:

• Streamlined operations: A single AWS organization reduces the complexity of managing multiple separate organizational structures. Teams can now implement consistent policies, configurations, and operational procedures across all accounts without conflicts or duplication. This unified approach reduces administrative overhead, decreases configuration drift between organizations, and provides centralized management of resources and permissions.

• Cost optimization: Consolidation improves Savings Plans and RI coverage across the enterprise, delivering additional cost savings. The consolidated billing structure supports better resource sharing between accounts and maximizes the value of committed spend. Simplified financial operations considerably reduce monthly cost allocation and reporting effort.

• Enhanced governance and control: Comprehensive governance frameworks with AWS Control Tower provide centralized management across all accounts. This approach simplifies security policy enforcement, standardizes compliance controls, and dramatically reduces audit preparation requirements. The consolidated structure helps with consistent tagging strategies and uniform security controls across the entire AWS environment.

Conclusion

Consolidating multiple organizations into a single structure transforms how you manage your cloud environment. Although the initial setup requires careful planning, you might get measurable improvements in operational efficiency, governance, and cost optimization without disrupting your business operations.

AWS Enterprise Support can help accelerate this consolidation effort. Your TAM works directly with your team to complete the following tasks:

1. Develop your consolidation strategy: Your TAM assesses your current multi-organization setup, identifies potential roadblocks, and builds a migration plan that's tailored to your business requirements.

2. Implement your new structure: Your TAM guides you through establishing your new organizational structure, migrating accounts efficiently, and configuring critical services, such as AWS Control Tower, and cost management tools.

3. Optimize your consolidated environment: Your TAM provides guidance on multi-account best practices and recommends management strategies.

4. Scale for future growth: Working with your TAM, you can design strategies that support expansion, align your organizational structure with business goals, and leverage new AWS capabilities that enhance your consolidated setup.

Consolidation isn't just about combining accounts. It's about building a foundation for operational excellence. Through AWS Enterprise Support, you get expert guidance to navigate complex migrations while maintaining security and compliance standards. Your TAM becomes your trusted partner, helping you create a more efficient, secure cloud infrastructure that scales with your business. To learn more, see AWS Support plans.

---

About the author

Sangram Thorat

Sangram Thorat is a Senior TAM for EdTech customers at AWS, where he helps enterprise customers optimize their workloads for security, reliability, and cost efficiency. With his expertise in edge services, such as content delivery network (CDN) and edge security, he helps customers optimize application performance and security. Based out of Boston, Massachusetts, Sangram is passionate about transforming education through technology.