AWS Organizations Consolidated Billing

AWS Organizations is a service that enables you to centrally manage multiple AWS accounts. Consolidated Billing is a feature of AWS Organizations that allows you to combine usage from all member accounts into a single monthly bill for the management (payer) account. This aggregation provides several cost benefits, including volume discounts, reserved instance sharing, and simplified billing.

Before AWS Organizations, managing multiple accounts meant each account had its own separate bill, with no way to combine usage for discounts. As organizations grew, they needed a way to:

Consolidated Billing solves these problems by treating all accounts as a single customer for pricing purposes while keeping each account's usage data separate for internal chargeback.

When you create an AWS Organization, you designate one account as the management (payer) account. All other accounts become member accounts. The payer account is responsible for paying the consolidated bill. The process works as follows:

Important Defaults:

One of the most powerful features of consolidated billing is the ability to share Reserved Instances and Savings Plans across accounts. AWS automatically applies any RI or Savings Plan discounts from any account in the organization to matching usage in any other account. This maximizes utilization and reduces waste.

How RI Sharing Works:

Example: If Account A buys 10 m5.large RIs in us-east-1, and Account B launches 5 m5.large instances in us-east-1, Account B's instances get the RI discount. Account A pays for the RIs, but the overall organization saves money because fewer instances run at on-demand rates.

Savings Plans: Similar to RIs, Savings Plans (Compute, EC2 Instance, or Machine Learning) are shared across accounts in the organization automatically. The discount applies to usage from any account.

With consolidated billing, the payer account can use Cost Explorer to view costs across all accounts, filter by account, tag, or service. Budgets can be set at the organization level or per account. Alerts can be sent when costs exceed thresholds.

Configuration Example: To create a budget that alerts when total organization costs exceed $10,000:

aws budgets create-budget \
    --account-id 123456789012 \
    --budget '{"BudgetName":"OrgBudget","BudgetLimit":{"Amount":"10000","Unit":"USD"},"TimeUnit":"MONTHLY","BudgetType":"COST"}' \
    --notifications-with-subscribers '[
        {"Notification":{"NotificationType":"ACTUAL","ComparisonOperator":"GREATER_THAN","Threshold":100},
         "Subscribers":[{"SubscriptionType":"EMAIL","Address":"admin@example.com"}]}
    ]'

Service Control Policies (SCPs) can be used to restrict actions that could increase costs. For example, you can deny launching EC2 instances of certain types or in certain regions. SCPs apply to all accounts in an OU or the entire organization.

Example SCP to deny launching GPU instances:

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Sid": "DenyGPUInstances",
      "Effect": "Deny",
      "Action": "ec2:RunInstances",
      "Resource": "arn:aws:ec2:*:*:instance/*",
      "Condition": {
        "StringLike": {
          "ec2:InstanceType": ["p*", "g*"]
        }
      }
    }
  ]
}

To list all accounts in an organization:

aws organizations list-accounts

To describe the organization:

aws organizations describe-organization

To see the consolidated billing details (in the console, navigate to Billing and Cost Management > Consolidated Billing).

A multinational corporation has multiple business units, each with its own AWS account for isolation. The central IT team uses AWS Organizations with consolidated billing to aggregate usage and get volume discounts. They purchase all Reserved Instances in the payer account, which automatically apply to any account that launches matching instances. This reduces overall EC2 costs by 30%. They use SCPs to restrict non-production accounts from launching expensive instance types (e.g., p3.16xlarge) and to enforce that all resources are tagged with a cost center. The finance team uses Cost Explorer to allocate costs back to business units based on tags. A common issue is that some teams forget to tag resources, making cost allocation inaccurate. To solve this, they use SCPs to deny launching resources without required tags.

A fast-growing startup uses separate AWS accounts for development, staging, and production. They consolidate billing to simplify payment and get volume discounts. They purchase Compute Savings Plans in the payer account, which cover all accounts. However, they initially configured the development account with its own payment method, which prevented it from being added to the organization. They had to migrate the account by closing it and recreating it under the organization. They also learned that the payer account cannot be changed, so they carefully chose the account to be the payer. A misconfiguration occurred when an SCP accidentally denied access to S3 for all accounts, causing production outages. They learned to test SCPs on a test OU first.

An MSP manages AWS accounts for multiple clients. They use AWS Organizations with consolidated billing for each client, creating separate organizations per client. They act as the payer account for each client's organization, handling billing and applying SCPs for security. They use Cost Explorer to generate client-specific reports. A common challenge is that each client's organization has a separate payer account, requiring multiple invoices. They automate account creation and policy management using AWS CloudFormation and the Organizations API. They also set up budgets to alert when a client's costs exceed expectations. One client accidentally launched a large number of instances, causing a spike; the budget alert helped the MSP quickly identify and shut down the resources.