What is the difference between an AWS IAM Group and an Organizational Unit?

Question

I'm investigating users and groups in AWS and have some confusion regarding an AWS IAM Group and an Organizational Unit. They both seem to implement the same functionality such as organizing like accounts with similar tasks and assigning policies to groups of accounts. What are the differences? Any further insight would be appreciated.

Chlores

Answer 1

An IAM group is a collection of IAM users, while an OU is a group of AWS accounts.

Decent

So an IAM user does not have to have or be an AWS account? The functionality seems very similar to the point where, if it were allowed, placing an IAM user into a OU would implement the same level of functionality. – Chlores

An IAM user must belong to an AWS account. – Decent

Can an AWS account have multiple IAM users assigned to it? – Chlores

OUs can be used in AWS' consolidated billing feature so that also differentiates them. – Chlores