Diagram of a Substrate-managed AWS organization

A Substrate-managed AWS organization is comprised of half-a-dozen or more AWS accounts all working together. Briefly, since these accounts are all discussed in detail elsewhere:

• Management account: Creates the AWS organization and organization-wide CloudTrail. Receives your bill.
• Audit account: Stores the organization-wide CloudTrail.
• Deploy account: Facilitates moving objects between accounts via S3. Useful as part of CI/CD processes.
• Network account: Creates VPCs and shares them into all the right service accounts.
• Admin account: Integrates with an identity provider, serves the Intranet, and helps authorized humans get into AWS.
• Service accounts: Contain all the rest of the AWS resources, serve your production traffic, and protect customers’ data.

Go deeper and take a look at a diagram of a multi-quality, multi-region service provisioned within two service accounts, as highlighted in grey at the top of this diagram.