Here are a few more things to keep in mind when managing your organization's accounts.

• Organizational Control Policies (OCPs) can be attached to your root, OU, or AWS accounts. At this time, only one kind of OCP is supported: SCP.
• Accounts can only belong to one OU or root.
• Similarly, OUs can only belong to one OU or root.
• It's best to avoid deploying resources in the master account because this account can't be controlled with SCPs. The master account should be treated as a management account for audit, control, and billing purposes only.