A company operates separate AWS accounts for its engineering, marketing, and finance departments. The CFO wants to consolidate billing to receive a single monthly invoice and to benefit from volume pricing discounts. The security team also requires a centralized mechanism to prevent users in any department from launching Amazon EC2 instances outside of the us-east-1 and eu-west-1 Regions to meet data residency compliance. Which AWS service or feature should the company use to meet both requirements?
Trap 1: AWS Budgets
AWS Budgets only tracks spend against thresholds and fires alerts; it cannot consolidate invoices or enforce Region restrictions. It is tempting because it addresses the CFO's cost visibility, and would be the right choice for notifying on budget overruns, not for billing consolidation or preventive guardrails.
Trap 2: AWS Identity and Access Management (IAM) cross-account roles
IAM cross-account roles enable users in one account to assume roles in another account for temporary access, but they do not provide a way to consolidate billing or enforce blanket restrictions like a region lock across all accounts. Setting up such restrictions would require manual configuration in each account and does not offer central enforcement.
Trap 3: AWS Cost and Usage Reports
AWS Cost and Usage Reports provide detailed cost and usage data that can be analyzed with tools like Amazon Athena, but they do not consolidate billing or provide any policy enforcement capabilities. They are a reporting tool, not a governance or billing consolidation service.
- A
AWS Budgets
Why it fails: AWS Budgets only tracks spend against thresholds and fires alerts; it cannot consolidate invoices or enforce Region restrictions. It is tempting because it addresses the CFO's cost visibility, and would be the right choice for notifying on budget overruns, not for billing consolidation or preventive guardrails.
- B
AWS Organizations with Service Control Policies (SCPs)
AWS Organizations provides consolidated billing for a single invoice and volume discounts, and SCPs allow you to centrally define and enforce permission guardrails (e.g., restricting Regions) across all member accounts. This directly meets both requirements.
- C
AWS Identity and Access Management (IAM) cross-account roles
Why it fails: IAM cross-account roles enable users in one account to assume roles in another account for temporary access, but they do not provide a way to consolidate billing or enforce blanket restrictions like a region lock across all accounts. Setting up such restrictions would require manual configuration in each account and does not offer central enforcement.
- D
AWS Cost and Usage Reports
Why it fails: AWS Cost and Usage Reports provide detailed cost and usage data that can be analyzed with tools like Amazon Athena, but they do not consolidate billing or provide any policy enforcement capabilities. They are a reporting tool, not a governance or billing consolidation service.