Sometime in 2023, a mid-sized financial institution I worked with consolidated all its business units under a single AWS Organization to simplify cost governance. Eighteen months later, a Service Control Policy mistake applied at the root node silenced the production payments pipeline for 47 minutes. The postmortem revealed something most architects know intuitively but rarely document rigorously: Organizations topology is not a FinOps decision — it is a blast radius decision.
What Happened: Context and Organizational Pressure
The pressure came from above. The CFO wanted consolidated cost visibility, the CISO wanted a single policy enforcement point, and the platform team — already stretched thin — wanted to reduce the number of landing zone automation pipelines. The obvious solution seemed to be: one Organization, multiple OUs, hierarchical SCPs. The reasoning was defensible on a whiteboard.
The problem started when the security team needed to block access to certain AWS regions for LGPD/GDPR compliance. The SCP was drafted with an aws:RequestedRegion condition denying all regions outside sa-east-1 and us-east-1. The test was run against a sandbox OU. Approval was granted. The deploy went to the root node — not the production OU, the root.
