11.2 Consolidated Billing
Last updated
Was this helpful?
Last updated
Was this helpful?
AWS Organizations is an relatively new topic may or may not appear in exam. AWS Organizations is an account management service that enables you to consolidate mulitple AWS accounts into an organization that you create and centrally manage. For example, you have a paying account, and all other accounts are linking to that paying account.
Available in two feature sets:
Consolidated Billing
All Features
Structure:
Root - root account (paying acccount), e.g. company level
OU - organization units within the root account, e.g. department level (e.g. HR, Engineering, etc)
AWS Account - you have multiple AWS accounts behind each OU, e.g. team level.
Policy - AWS organizations allows you to apply policies and you can apply those policies either to the organization units individually or you can apply a policy to a root account which means that all our organization units underneath those root accounts will adopt these policies and all of AWS accounts underneath those use will also adopt those policies.
This is a must have topic in exam. You can link accounts to one paying account, and you will receive one billing for your organization per month. You can break the bill down by your linked accounts. In a normal consolidated billing, all linked accounts are independent, and paying account is also independent so it cannot access resources of the other accounts. Currently, a limit of 20 linked accounts for consolidated billing.
Advantages of consolidated billing:
One bill per AWS account
Very easy to track charges and allocate costs
Volume pricing discount (cheaper than pay individually)
Best practice:
Always enable multi-factor authentication on root account
Always use a strong and complex password on root account
Paying account should be used for billing purpose only. Do not deploy resources in to paying account.
Other things to note:
Linked Accounts
20 linked accounts only
To add more: search "aws contact us aws account and billing"
Billing Alerts
When monitoring is enabled on the paying account the billing data for all linked accounts is included.
CloudTrail
Per AWS account and is enabled per region
You still can have consolidate logs using an S3 bucket. How to do that:
Turn on CloudTrail in the paying account
Create a bucket policy that allows cross account access
Turn on CloudTrail in the other accounts and use the bucket in the paying account
Consolidated billing allows you to get volume discounts on all your accounts.
Unused reserved instances for EC2 are applied across the group.
CloudTrail is on a per account and per region basis but can be aggregated in to a single bucket in the paying account.