A service for centrally managing and governing multiple AWS accounts.
AWS Organizations lets a company consolidate many AWS accounts under a single management account. Accounts are arranged into Organizational Units (OUs), which can nest inside one another, allowing teams or business units to operate in isolated accounts while sharing centralized governance. Consolidated billing rolls every member account’s usage into one monthly invoice, enabling volume pricing discounts across the organization. The exam often pairs Organizations with Service Control Policies (SCPs), permission guardrails attached to OUs or accounts. SCPs do not grant permissions — they only restrict what IAM identities in member accounts may do, so an SCP can block an action even if an account’s IAM policy explicitly allows it.
A feature of AWS Organizations that combines billing for all member accounts into one bill.
Consolidated billing is a feature of AWS Organizations that rolls all member account charges into a single monthly invoice paid by the management account (formerly called the master account). It also enables volume discount aggregation: usage from every linked account is combined before pricing tiers apply, so reaching the next Reserved Instance, Savings Plans, or data-transfer tier happens faster than any single account could alone. The exam tests this cost-pooling benefit against the broader governance of AWS Organizations (service control policies, organizational units). Consolidated billing is purely financial — it does not grant the management account access to resources inside member accounts.
A service that sets up and governs a secure, multi-account AWS environment with best practices.
AWS Control Tower is a managed service that automates setting up a secure, well-architected, multi-account environment called a landing zone. It provisions foundational accounts, configures AWS Organizations, and enables AWS CloudTrail and AWS Config across accounts, then applies pre-built controls (formerly called guardrails) to enforce governance. Controls are preventive (Service Control Policies that block actions) or detective (Config rules that flag non-compliance). For the exam: Control Tower sits on top of Organizations, adding automated provisioning and compliance — so when a question describes centrally governing many accounts with a standard landing zone, Control Tower is the answer.
A tool that inspects an account and recommends improvements across several categories.
AWS Trusted Advisor is an automated advisory tool that scans an account and surfaces recommendations across six categories: cost optimization, performance, security, fault tolerance, service limits, and operational excellence (added in 2023). It compares the configuration against AWS best practices, flagging gaps such as open security group ports, underutilized EC2 instances, or service quotas nearing their ceiling. The key exam nuance is support-plan gating: Basic and Developer plans grant a small core subset of checks, while Business, Enterprise On-Ramp, and Enterprise plans unlock the full catalog plus access via the Trusted Advisor API. Do not confuse it with AWS Config, which tracks configuration changes over time.
Tiered support offerings — Basic, Developer, Business, Enterprise On-Ramp, and Enterprise — with rising response and access.
AWS offers five support tiers: Basic (free, included with every account), Developer, Business, Enterprise On-Ramp, and Enterprise. As tiers rise, customers gain shorter guaranteed response times for critical cases, more support channels, and proactive services such as Infrastructure Event Management. A key exam distinction is that Trusted Advisor’s full set of checks unlocks only at Business tier and above, while Basic and Developer see a limited subset. Enterprise adds a designated Technical Account Manager (TAM) and Concierge support; Enterprise On-Ramp provides a pool of TAMs at a lower price than full Enterprise.
A digital catalog to find, buy, and deploy third-party software that runs on AWS.
AWS Marketplace is a curated digital catalog where customers find, subscribe to, and deploy thousands of third-party software products that run on AWS. Products use varied pricing models — free trials, hourly or annual subscriptions, and bring-your-own-license (BYOL) — and charges are consolidated onto the customer’s AWS bill rather than a separate vendor invoice. A common exam trap is treating it as a place to buy AWS-native services; it is specifically for third-party software (security tools, operating systems, machine learning models) from independent vendors. Unlike AWS Service Catalog, which administrators use to manage internally approved resource portfolios, Marketplace handles external commercial software procurement.