One Org or Many? The Postmortem Nobody Wants to Write

Short summary

A financial organization's consolidation of AWS accounts under a single Organization caused a 47-minute payment pipeline outage when a Service Control Policy was accidentally applied at the root node instead of a sandbox. The root cause was architectural: single Organizations create instant policy propagation across all accounts with no canary deploy or automatic rollback. Separate Organizations per workload boundary with independent SCP lifecycles are essential for regulated workloads.

• •Single AWS Organization caused 47-minute payment outage when regional SCP was applied to root instead of sandbox OU
• •Root cause: architectural design enabled instant organization-wide blast radius with zero staging or rollback mechanism
• •Remediation: separate Organizations per workload with independent SCP lifecycles and controlled cross-organization sharing

Generated with AI, which can make mistakes.