Stéphane: So just a little bit of extra information
regarding organizations for the SysOps exam.
The first of all, you can enable
what's called Reserved Instances sharing
in your organization.
That means that all the accounts of your organizations
will have access to all the Reserved Instances.
And so, that means that any account can use
any other's accounts' RI's,
and this is obviously for cost saving.
But, you may want to disable that
for any specific account,
including the payer accounts,
in which case, the Reserved Instances
or even your savings plans
will not be shared across accounts.
Okay, so this is something to know.
It's a setting you have to turn on and off,
but for having the RI or the Savings Plan discounts enabled
between two accounts, they must both have sharing turned on.
The second thing is that using organizations,
you can use a specific condition in your IAM policies called
the aws:PrincipalOrgID
to allow access from any,
IAM principles from all the accounts in your organization.
So, say you have an organization with a management account
and two member accounts with different IAM users.
If you set up an extra bucket
and you're using the bucket policy,
the aws:PrincipalOrgID condition,
then you're giving access automatically to any user
or any roles within your organization to this extra buckets.
So, it's a good way for you to not have to specify
every individual accounts,
but instead reference only the leading organization
of your accounts.
Finally, you can implement tag policies for your accounts.
So, this is a different way to do some policies.
So, we've seen that there are service control policies,
but also tag policies.
And this is your enforce tagging in your accounts.
So, this is your standardize, all the tags
and the goal is to maybe audit tagged resources,
maintain proper resource categorization.
So they find the tag keys in their lab values.
And obviously if you have cost allocation tags enabled,
or if you do attribute-based access controls,
then this can be very, very helpful.
And then regarding the non-compliance of your tags.
So it's possible for you to generate a list
that will show you all the non-compliant resources
and you can use CloudWatch Events as well
to monitor non-compliant tags if you needed to.
So, that's it for organizations.
I hope you liked it.
And I will see you in the next lecture.