All cheat sheets
Cost Governancecheat sheet

AWS Organizations Consolidated Billing

The free multi-account structure that pools volume-tier pricing and auto-shares one Reserved Instance or Savings Plan across every linked account. Going from one big account to a 5-account Org costs $0 and unlocks 5–15% of the bill.

Last reviewed: July 14, 2026

Prefer step by step? Take the guided AWS Organizations Consolidated Billing walkthrough — free, anonymous, interactive.Have an AI assistant? Jump to the copy-paste audit prompt at the bottom of this sheet.

TL;DR: Multi-account AWS is the default beyond "two engineers and a side project," and AWS Organizations + Consolidated Billing is the free structure that makes it pay: volume-tier pricing aggregates across accounts, and a Reserved Instance or Savings Plan bought in one account auto-shares to every account in the Org by default. Going from one big account to a 5-account Org costs $0 and typically unlocks 5–15% of the total bill — the highest-ROI cost move in AWS. The catch is discipline: keep the management account near-empty and never let accounts silently opt out of sharing.

The numbers

  • Volume tiers aggregate: S3 drops price at 50 TB and 500 TB — two accounts at 40 TB each pay first-tier rates separately, but summed to 80 TB in one Org, everything above 50 TB gets the cheaper tier. Data-transfer-out tiers similarly.
  • RI/SP sharing is the default — a single Compute Savings Plan in the management account can cover EC2 across every member account, sized against Org-wide usage, not per-account.
  • Structural change costs $0 but unlocks 5–15% in volume-tier + shared-commitment savings.
  • Field examples: a 60-person startup captured ~$3,200/mo from S3 tier aggregation + a suddenly-Org-wide SP the first month, then ~$5,000/mo more by centralizing SP purchases (~$98K/yr); a 200-account enterprise found 34 accounts opted out of sharing and recovered ~$28K/mo by re-enabling it.

Do this

  1. Create the Org in "All features" mode (not consolidated-billing-only — you want SCPs and account management too), even with just one workload account today.
  2. Keep the management account near-empty — it exists to pay the bill and own Org config; workloads in it are a security and recovery liability. Plan to drain an existing main account over 3–12 months.
  3. Centralize Savings Plans purchases in the management (or a dedicated "Savings") account, sized from Cost Explorer's SP recommendation with the linked-account filter set to all accounts — never buy fragmented per-account commitments.
  4. Audit RI/SP discount sharing periodically — Billing Preferences per account; treat any opt-out as a documented, annually-reviewed exception.
  5. Group accounts into OUs matching the business (prod, non-prod, sandbox, security, logging) so SCPs and backup plans attach cleanly.

Gotchas

  • Volume savings are automatic but invisible — no "you saved $X from tier pricing" line; it shows only as a bill lower than the sum of list prices.
  • Per-account sharing opt-out breaks the Org-wide commitment math — the leading cause of "we bought an SP but production still shows on-demand."
  • The management account can never leave its own Org and some actions don't apply to it — plan accordingly.
  • Cross-account workload migration is painful — S3 buckets can't be transferred (copy), RDS needs snapshot-share, KMS keys can't move at all; account closure is a 90-day process.
  • Overly-restrictive SCPs can deny even root in member accounts — test on a non-critical OU first.

Skip this if

  • You genuinely have one tiny workload and no second account on the horizon — but even then, set the Org up now; the right time was the first account, the second-best is today. The commitment that delivers the bulk of Org-level savings is Compute Savings Plans (and Reserved Instances for non-EC2); pair the structure with Budget Actions for enforcement and Cost Categories to align billing views to your OU tree.

Run this audit with your AI assistant

Paste this into Claude, ChatGPT, or any agent that can run the AWS CLI with read-only credentials. It audits your account for exactly the waste this sheet describes — and changes nothing.

You are auditing an AWS Organization's consolidated-billing setup for
savings leakage. Use the AWS CLI with READ-ONLY credentials. Do not
create, modify, or delete anything — report findings and recommended
(unapplied) fixes only.

1. Structure: aws organizations describe-organization + list-accounts +
   list-organizational-units-for-parent — confirm All-features mode, map
   accounts to OUs, and flag WORKLOADS running in the management account
   (should be near-empty).
2. RI/SP sharing leakage: check Billing Preferences per account — flag
   any account opted OUT of RI/Savings Plans discount sharing (breaks
   Org-wide commitment math). Cross-reference on-demand EC2 spend in
   opted-out accounts that a shared commitment could cover.
3. Commitment centralization: identify fragmented per-account Savings
   Plans that should be centralized; use ce get-savings-plans-purchase-
   recommendation with LINKED_ACCOUNT scope = all to size Org-wide.
4. Cleanup: flag $0-spend accounts idle 6+ months (closure candidates)
   and outdated SCPs blocking legitimate regions/services.

Report a table: finding | accounts affected | est. $/mo recoverable |
recommendation (re-enable sharing / centralize SPs / drain mgmt account /
close idle). Change nothing.
Works with any assistant that can run shell commands.

Want the guided version?

The AWS Organizations Consolidated Billing walkthrough covers this topic interactively — it asks about your setup, branches to what’s relevant, and quizzes you on the tricky parts. Free and anonymous.

Start the walkthrough

More Cost Governance cheat sheets

AWS Billing Conductor

Billing Conductor restructures how a bill is allocated and presented internally — pro-forma invoices with custom rates, markups, and line items — without changing what AWS actually charges. It's an accounting tool for MSPs and complex chargeback, not a savings tool.

AWS Budget Actions

A regular budget emails you; a Budget Action does the thing for you — attach a deny-IAM policy, apply an SCP, or stop tagged EC2/RDS when a threshold breaks. The difference between an alarm and a circuit breaker, and it costs nothing extra.

AWS Budgets

The one cost-governance feature to set up first: a threshold plus a notification that pings you before the bill lands. Forecasted-80% is the single most effective alert AWS offers; first two budgets are free.

AWS Cost and Usage Reports

Cost Explorer is a dashboard; CUR is the database. Every billing line item — one resource × one hour × one usage type, hundreds of columns — dumped to S3 for Athena/QuickSight when the question doesn't fit Cost Explorer's dropdowns. Use CUR 2.0 via Data Exports.