Hands-on emulator lab · 6–10 min
Prepare an organization policy boundary — Organizations and Policy API limits
Create an organizational unit and inspect the emulator’s policy limitation.
Organizational-unit APIs work in this emulator, but SCP creation and attachment do not. This lab creates a unit and requires observing the real NotImplemented policy response. It never claims that a guardrail is enforced.
Your goal
Create an organizational unit and inspect the emulator’s policy limitation.
Why this matters
An organization groups accounts into units where shared permission limits can apply. You will create a unit and inspect the emulator’s unsupported policy response. No service control policy is created or enforced.
Words you will use
An organizational unit groups accounts beneath an organization root. A service control policy limits permissions and does not grant them. NotImplemented means this emulator has no implementation of the requested operation.
How to proceed
Start a fresh emulator, read each numbered step, and enter the practice settings shown. Run the action, inspect its API receipt, then continue. Finish lab checks the emulator state again before saving your progress.
1. Find the organization root
List the roots of the emulator’s practice organization. An organizational unit groups accounts beneath a root. Service control policies can limit permissions across parts of a real organization.
2. Create a policy boundary to organize accounts
Choose a team label and create an organizational unit beneath the root. Then try to create a narrow guardrail policy. The installed emulator returns NotImplemented for CreatePolicy; that expected response is shown rather than treated as a deployed guardrail.
Practice label: This label is saved in the emulator. Use 1–80 characters. Suggested practice value: moonbase.
3. Verify the organizational unit
Describe the unit and compare its name with your label. You created a real organization structure record, but no service control policy was created or attached. An SCP limits permissions; it does not grant them.
Practice, then check your understanding
Perform the actions yourself and inspect the returned state. Errors keep your settings so you can retry. Starting another lab clears the previous live environment. Earned XP is kept, and signed-in achievements sync to your account. Replay does not award duplicate XP.
Read the official AWS documentation for service behavior and production details.