Pattern A: one AWS Organization with country-specific accounts
Works when there is a shared product or platform, a common security team, and a need to allocate cost by country.
- Central security/logging account, country-specific production accounts, and data zones with clear retention policies.
- IAM Identity Center or common federation, with groups, break-glass access, and bilingual runbooks.