Question

A large enterprise has 12 independent AWS accounts, each created ad hoc by different business units with their own payer relationships. The CFO wants to consolidate billing, apply organization-wide governance, and eventually enforce SCPs — but each business unit must retain full control of its existing workloads and root credentials during the transition with zero disruption to running services. The security team also wants the ability to later apply preventive guardrails centrally. What is the MOST appropriate approach to bring these accounts under a single AWS Organization?

Accepted Answer

Create a new management account, then send each existing account an invitation to join the organization; accept the invitations from within each member account.

Answer

Use AWS Control Tower Account Factory to recreate each business unit workload in freshly provisioned member accounts, then decommission the original accounts.

Answer

Designate one existing business unit account as the management account and use the CreateAccount API to migrate the other 11 accounts' resources into it.

Answer

Enable consolidated billing by adding each account's payment method to a shared billing profile without forming an AWS Organization.