Hear you and welcome back now in the earlier video we were discussing about the basics of aid of this
organization.
We looked into the two core features which are consolidated billing and the policies as well.
So what will you be doing today?
Will be creating our first organization.
We'll look into how we can go ahead and join the account with the organization and will also look into
how we can create a service control policy.
So let's get started.
So for today's video, we have two eight of these accounts data available in two different taps.
The first account will be using it as a management account, and that is why I also named their tab
as manager database.
And the second that will be using it as a member account.
So member counties read, all of the organization policies will be applied.
Great.
So from our management account, let's go ahead and open up the organization's service.
Great.
And the first thing that needs to be done is you have to create an organization and force state whenever
you create an organization, it will go ahead and send you the verification email.
So you'll have to go ahead and accept it.
So basically, this is how the email looks like, so you'll have to verify the email address.
Now let me go ahead and piece the verification link.
Great.
So as soon as you do it, it basically states that your email address has been verified.
That's great.
I'll close this gap, and from our first down, let's refresh the page.
Great.
Now, at this stage, you'll see that you have one account, and it is also showing you that this is
a management account.
So from this account, you can go ahead and do various things like apply policies to member account
and various others.
Now you can also go ahead and invite another account.
So let's do an ad account so you can either create a new account or you can invite an existing account.
Now, since I already have an existing eatables account available, I'll be using that and within you.
Let's go ahead and base the account I.D..
I'll be straight here.
And let's send an invitation.
Great.
So the invitation has been sent, so from the organization's service of the member account to which
the invitation was sent, you will receive a notification now within the U.S. it states you have an
invitation available safe will quickly open up the invitation.
It basically shows you from which account the invitation has come from.
I'll go ahead and I'll accept the invitation yet ball.
So the invitation has been accepted.
So from our management account, if you will refresh the page now you see you have to account for this
one is the management account.
Second, one is the member account.
Great.
So now let's do one thing similar to the policy demo that we had seen where we go ahead and apply a
specific policy to an account.
And once the policy is applied, not even a root user of that account can access that service.
Let's go ahead and try it out.
So from the management database will go to policies, and the policy that we are interested is the service
control policy.
These are a very important set of policies.
Let's go ahead and enable that.
Great.
Now, at this stage, you have a full IWC access base managed policy that is available now.
Let's go ahead and create a new policy.
The policy name, let's call it, has denied all S3, and from here you can go ahead and specify various
services actions as well.
So I say is three, let's specify all the actions within the resource.
Let's specify all resource and click on Add Resource.
So this is how the policy statement would look like once then you can go ahead and create a policy.
Great.
Now at this date, this policy is not associated with any account.
So if you want to verify from our memory levels account, if you go to the S3 service, you should be
able to see the S3 console and you can even create bucket and do various operations here.
Now, once your service control policy is created, the next step is you have to associate it with the
account you can edit associated with all the accounts, or you can even associate with this specific
account that you want to isolate.
So what we do will go ahead and associate this with our memory cards since we only have one member account
available.
But we can go ahead and select this account and we'll attach policy greatsword, the name S3 policies
associated and now from our member account, a file refresh the page and now you see immediately you
get a permission denied message.
You also have an option to detach the policy.
So under the ACP, you have a target you can go ahead and detach the target here and once.
Then if you'll refresh the page, you see the error anyway.
That's great.
No one more important thing that I wanted to show you is that at this stage, if you will quickly open
up the billing console, you'll not be able to see the bills associated with all of the accounts, including
the member account, primarily because the invoices are not generated.
But after the invoices are generated, you will be able to see the bill associated with both the management
as well as the member account that we have created.
That's great.
So go ahead and try it out.
I'll really encourage you to practice this out of his control policies.
They're very important, and in most of the organizations that are major in terms of security, service,
control policies are extensively used.
So with this will conclude today's video.