Organizations, account boundaries, budgets and cost management

Why and what

Separate accounts provide stronger administrative/billing boundaries than tags alone. AWS Organizations groups accounts and supports policies. Organizational units organize policy application. Service control policies set permission ceilings; they do not grant a user permissions. IAM permissions must still allow the action, and SCP effects have important management-account/service-linked-role exceptions.

Planning exercise

Design separate sandbox, development, production and log-archive accounts. Define who can administer each, how people obtain temporary access, and which services/Regions are allowed. Use IAM Identity Center for workforce access where suitable. Consider Control Tower when a managed landing-zone approach fits the organization.

Cost lab

1. Activate useful cost-allocation tags and wait for cost data to become available.
2. Use Cost Explorer to group by service, account and Region. Compare usage quantity with cost rather than assuming a price changed.
3. Find idle load balancers, NAT gateways, public IPv4 allocations, unattached volumes and old snapshots.
4. Configure budgets and anomaly notifications to addresses you control.
5. Produce a small estimate for EC2, EBS, RDS, S3 and outbound transfer using the current calculator.

Purchase models

On-Demand buys flexibility. Savings Plans/Reserved Instance arrangements involve commitments and scope rules; evaluate steady usage before purchasing. Spot capacity can be interrupted and suits interruption-tolerant workloads. Rightsizing requires CPU, memory, I/O and business timing evidence, not only average CPU.

Safety boundary

Do not apply a restrictive SCP to the organization's root as a classroom experiment. Test in a sandbox OU with a recovery plan. A deny on Regions can inadvertently affect global-service workflows unless exceptions are designed correctly. Never purchase commitments as a routine lab step.

Verification and assignment

Explain why a budget alert did not automatically stop a server. Prepare an account-by-account access matrix and a daily cleanup checklist. Identify one cost that persists after EC2 stop and one after instance termination.

Official references

AWS Organizations AWS Budgets

Interview and revision check

Does an SCP grant access?

No. It constrains maximum permissions for affected principals. Identity/resource policies must still grant the action.