Account Management, Billing & Support

1. AWS Organizations

AWS Organizations is a global service that lets you manage multiple AWS accounts as one. The main account is the master account (also called the management account); the others are member accounts.

The cost benefits are the headline:

Consolidated Billing across all accounts — a single payment method for everything.
Pricing benefits from aggregated usage — volume discounts for EC2, S3 and so on are computed on the combined usage of the whole organization.
Pooling of Reserved EC2 instances for optimal savings.

Two more capabilities matter:

An API is available to automate AWS account creation, so new accounts can be spun up programmatically.
Account privileges can be restricted with Service Control Policies (SCP).

2. Multi-account strategies

Why create several accounts rather than one big one? The slides list the usual reasons:

Per department, per cost center, per dev / test / prod environment.
Based on regulatory restrictions (enforced with SCP).
For better resource isolation (for example a separate VPC per account).
To get separate per-account service limits.
To keep an isolated account for logging.

That is the Multi Account vs One Account Multi VPC decision. Whichever way you go, the operational practices are the same:

Use tagging standards for billing purposes.
Enable CloudTrail on all accounts and send the logs to a central S3 account.
Send CloudWatch Logs to a central logging account.

Organizational Units (OU)

Accounts are grouped into Organizational Units. The deck shows three common layouts: by Business Unit, by Environmental Lifecycle (Dev / Test / Prod) and Project-based.

A typical tree looks like this:

Root OU
└── Master Account
    ├── Prod OU
    ├── Dev OU
    ├── Finance OU
    └── HR OU

3. Service Control Policies (SCP)

An SCP whitelists or blacklists IAM actions. The details the exam picks at:

Applied at the OU or Account level.
Does not apply to the Master Account — the management account cannot be restricted by an SCP.
Applied to all Users and Roles of the account, including the Root user.
Does not affect service-linked roles — those let other AWS services integrate with AWS Organizations and cannot be restricted by SCPs.
An SCP must have an explicit Allow — it does not allow anything by default.

Use cases: restrict access to certain services (for example, nobody may use EMR), or enforce PCI compliance by explicitly disabling services. Both blacklist and whitelist strategies are possible.

4. Consolidated Billing

When Consolidated Billing is enabled on an AWS Organization you get:

Combined Usage — usage across all accounts in the organization is combined so they share volume pricing, Reserved Instances and Savings Plans discounts.
One Bill for all AWS accounts in the organization.

The management account can turn off Reserved Instances discount sharing for any account in the organization, including itself.

5. AWS Control Tower

AWS Control Tower is the easy way to set up and govern a secure and compliant multi-account AWS environment based on best practices.

Benefits:

Automate the set-up of your environment in a few clicks.
Automate ongoing policy management using guardrails.
Detect policy violations and remediate them.
Monitor compliance through an interactive dashboard.

Control Tower runs on top of AWS Organizations: it automatically sets up AWS Organizations to organize accounts and implement SCPs.

6. AWS Resource Access Manager (AWS RAM)

AWS RAM lets you share AWS resources that you own with other AWS accounts — with any account, or only within your Organization. The point is to avoid resource duplication.

Supported resources include Aurora, VPC Subnets, Transit Gateway, Route 53, EC2 Dedicated Hosts and License Manager Configurations.

7. AWS Service Catalog

Users who are new to AWS have too many options and may create stacks that are not compliant with the rest of the organization. Some users just want a quick self-service portal to launch a set of authorized products pre-defined by admins — virtual machines, databases, storage options and so on.

That is AWS Service Catalog:

Admins write CloudFormation Templates, which become Products.
Products are collected into a Portfolio.
IAM permissions control who can access which portfolio, and therefore which product list a user sees.
Users launch from that list and get Provisioned Products that are ready to use, properly configured and properly tagged.

8. Pricing models in AWS

AWS has 4 pricing models:

Pay as you go — pay for what you use, remain agile and responsive, meet scale demands.
Save when you reserve — minimize risks, predictably manage budgets, comply with long-term requirements. Reservations are available for EC2 Reserved Instances, DynamoDB Reserved Capacity, ElastiCache Reserved Nodes, RDS Reserved Instances and Redshift Reserved Nodes.
Pay less by using more — volume-based discounts.
Pay less as AWS grows — AWS keeps lowering prices.

Free services and the Free Plan

A new AWS account gets up to $200 in credits.
You choose between a Free Plan and a Paid Plan.
The Free Plan expires in 6 months or when the credits are consumed — no charges either way.
The Paid Plan is charged after you consume your credits.
Both plans have access to Always Free Services, which offer monthly free usage limits — for example Lambda with 1,000,000 requests/month and 400,000 GB-seconds of compute/month, and DynamoDB with 25 GB of storage and 200M requests/month.

9. Compute pricing

EC2

You are only charged for what you use. The price depends on:

The number of instances.
The instance configuration: physical capacity, Region, OS and software, instance type, instance size.
ELB running time and amount of data processed.
Detailed monitoring.

The purchasing options:

Option	What it costs
On-demand	Minimum of 60s; pay per second (Linux/Windows) or per hour (other OS)
Reserved	Up to 75% discount vs On-demand hourly rate; 1- or 3-year commitment; all upfront / partial upfront / no upfront
Spot	Up to 90% discount vs On-demand; you bid for unused capacity
Dedicated Host	On-demand, or reservation for 1 or 3 years

Savings Plans are the alternative for saving on sustained usage.

Lambda and ECS

Lambda — pay per call and per duration.
ECS, EC2 Launch Type Model — no additional fees; you pay for the AWS resources stored and created in your application.
Fargate Launch Type Model — pay for the vCPU and memory resources allocated to your applications in your containers.

10. Storage pricing

S3

Pricing depends on:

The storage class: S3 Standard, S3 Infrequent Access, S3 One-Zone IA, S3 Intelligent Tiering, S3 Glacier, S3 Glacier Deep Archive.
Number and size of objects — the price can be tiered based on volume.
Number and type of requests.
Data transfer OUT of the S3 region.
S3 Transfer Acceleration.
Lifecycle transitions.

EFS is similar: pay per use, with an infrequent access class and lifecycle rules.

EBS

Volume type (based on performance).
Storage volume in GB per month provisioned.
IOPS — included for General Purpose SSD; billed on the provisioned amount for Provisioned IOPS SSD; billed on the number of requests for Magnetic.
Snapshots — added data cost per GB per month.
Data transfer — outbound is tiered for volume discounts, inbound is free.

11. Database and content delivery pricing

RDS

Per hour billing.
Database characteristics: engine, size, memory class.
Purchase type: On-demand, or Reserved Instances (1 or 3 years) with optional up-front payment.
Backup Storage: there is no additional charge for backup storage up to 100% of your total database storage for a Region.
Additional storage per GB per month, and the number of input and output requests per month.
Deployment type — storage and I/O are variable between Single AZ and Multiple AZs.
Data transfer — outbound tiered for volume discounts, inbound free.

CloudFront

Pricing is different across geographic regions.
It is aggregated for each edge location, then applied to your bill.
Driven by Data Transfer Out (with volume discounts) and the number of HTTP/HTTPS requests.

12. Networking costs

Simplified, per GB:

Traffic	Cost
Traffic in to AWS	Free
Between AZs in the same Region using private IP	$0.01
Between AZs in the same Region using Public IP / Elastic IP	$0.02
Inter-region	$0.02
Within the same AZ using private IP	Free

Two takeaways from the slide:

Use Private IP instead of Public IP for good savings and better network performance.
Use the same AZ for maximum savings — at the cost of high availability.

13. Savings Plans

A Savings Plan commits you to a certain $ amount per hour for 1 or 3 years — the easiest way to set up long-term commitments on AWS.

EC2 Savings Plan — up to 72% discount compared to On-Demand. You commit to usage of individual instance families in a Region (e.g. C5 or M5), regardless of AZ, size (m5.xl to m5.4xl), OS (Linux/Windows) or tenancy. All upfront, partial upfront or no upfront.
Compute Savings Plan — up to 66% discount compared to On-Demand, regardless of family, Region, size, OS, tenancy or compute option. Compute options covered: EC2, Fargate, Lambda.
Machine Learning Savings Plan — SageMaker and friends.

You set them up from the AWS Cost Explorer console, and can estimate pricing at https://aws.amazon.com/savingsplans/pricing/.

14. AWS Compute Optimizer

AWS Compute Optimizer reduces costs and improves performance by recommending optimal AWS resources for your workloads.

Helps you choose optimal configurations and right-size workloads that are over- or under-provisioned.
Uses Machine Learning to analyze your resources’ configurations and their utilization CloudWatch metrics.
Supported resources: EC2 instances, EC2 Auto Scaling Groups, EBS volumes, Lambda functions.
Can lower your costs by up to 25%.
Recommendations can be exported to S3.

15. Billing and costing tools

The deck groups them by job:

Estimating costs in the cloud: Pricing Calculator.
Tracking costs in the cloud: Billing Dashboard, Cost Allocation Tags, Cost and Usage Reports, Cost Explorer.
Monitoring against cost plans: Billing Alarms, Budgets.

AWS Pricing Calculator

Available at https://calculator.aws/, it estimates the cost for your solution architecture — before you build it.

AWS Billing Dashboard

The high-level overview of what your account is spending.

Cost Allocation Tags

Use cost allocation tags to track your AWS costs on a detailed level. Two kinds:

AWS generated tags — automatically applied to the resource you create, prefixed with aws: (e.g. aws:createdBy).
User-defined tags — defined by you, prefixed with user:.

Tagging and Resource Groups

Tags organize resources: EC2 (instances, images, load balancers, security groups), RDS, VPC resources, Route 53, IAM users and so on. Resources created by CloudFormation are all tagged the same way.

Naming is free; common tags are Name, Environment, Team. Tags can then be used to create Resource Groups — create, maintain and view a collection of resources that share common tags — and the tags themselves are managed with the Tag Editor.

Cost and Usage Reports

The AWS Cost & Usage Report contains the most comprehensive set of AWS cost and usage data available, including additional metadata about AWS services, pricing and reservations (e.g. EC2 Reserved Instances).

It lists AWS usage for each service category used by an account and its IAM users in hourly or daily line items, plus any tags you have activated for cost allocation. It can be integrated with Athena, Redshift or QuickSight.

Cost Explorer

Cost Explorer lets you visualize, understand and manage your AWS costs and usage over time:

Create custom reports that analyze cost and usage data.
Analyze at a high level — total costs and usage across all accounts — or with monthly, hourly, resource-level granularity.
Choose an optimal Savings Plan to lower prices on your bill (the alternative to Reserved Instances).
Forecast usage up to 12 months based on previous usage.

16. Billing Alarms and Budgets

Billing Alarms in CloudWatch

The billing data metric is stored in CloudWatch us-east-1.
Billing data covers overall worldwide AWS costs.
It is for actual cost, not projected costs.
It is intended as a simple alarm — not as powerful as AWS Budgets.

AWS Budgets

AWS Budgets creates a budget and sends alarms when costs exceed it.

4 types of budgets: Usage, Cost, Reservation, Savings Plans.
For Reserved Instances (RI) it tracks utilization, supporting EC2, ElastiCache, RDS, Redshift.
Up to 5 SNS notifications per budget.
Can filter by Service, Linked Account, Tag, Purchase Option, Instance Type, Region, Availability Zone, API Operation and more — the same options as AWS Cost Explorer.

17. Cost Anomaly Detection and Service Quotas

AWS Cost Anomaly Detection

Continuously monitors your cost and usage using ML to detect unusual spends.

It learns your unique historic spend patterns to detect a one-time cost spike and/or continuous cost increases — you don’t need to define thresholds.
Monitors AWS services, member accounts, cost allocation tags or cost categories.
Sends an anomaly detection report with root-cause analysis.
Notifies you with individual alerts or daily/weekly summaries (using SNS).

The flow on the slide: Create Cost Monitor → Get Alerted → Analyze Root Cause.

AWS Service Quotas

Service Quotas notifies you when you’re close to a service quota value threshold.

Create CloudWatch Alarms from the Service Quotas console — for example on Lambda concurrent executions.
Then request a quota increase from AWS Service Quotas, or shut down resources before the limit is reached.

18. Trusted Advisor

Trusted Advisor is a high-level AWS account assessment — no need to install anything.

It analyzes your AWS accounts and provides recommendations in 6 categories:

Cost optimization
Performance
Security
Fault tolerance
Service limits
Operational Excellence

With a Business or Enterprise Support plan you get the full set of checks and programmatic access using the AWS Support API.

19. AWS Support plans

Basic Support is free.

Basic

Customer Service & Communities — 24x7 access to customer service, documentation, whitepapers and support forums.
AWS Trusted Advisor — access to the 7 core Trusted Advisor checks and guidance to provision your resources following best practices.
AWS Personal Health Dashboard — a personalized view of the health of AWS services, with alerts when your resources are impacted.

Developer

All of Basic, plus:

Business hours email access to Cloud Support Associates.
Unlimited cases / unlimited contacts.
Response times: General guidance < 24 business hours, System impaired < 12 business hours.

Business (24/7)

Intended for production workloads.

Trusted Advisor — full set of checks + API access.
24x7 phone, email and chat access to Cloud Support Engineers.
Unlimited cases / unlimited contacts.
Access to Infrastructure Event Management for an additional fee.
Response times add: Production system impaired < 4 hours, Production system down < 1 hour.

Enterprise On-Ramp (24/7)

Intended for production or business-critical workloads. All of Business, plus:

Access to a pool of Technical Account Managers (TAM).
Concierge Support Team (billing and account best practices).
Infrastructure Event Management, Well-Architected & Operations Reviews.
Response times add: Business-critical system down < 30 minutes.

Enterprise (24/7)

Intended for mission-critical workloads. All of Business, plus:

Access to a designated Technical Account Manager (TAM).
Concierge Support Team.
Infrastructure Event Management, Well-Architected & Operations Reviews.
Access to AWS Incident Detection and Response (for an additional fee).
Response times add: Business-critical system down < 15 minutes.

20. Account best practices — summary

Operate multiple accounts using Organizations.
Use SCP to restrict account power.
Easily set up multiple accounts with best practices using AWS Control Tower.
Use Tags & Cost Allocation Tags for easy management and billing.
IAM guidelines: MFA, least privilege, password policy, password rotation.
Config to record all resource configurations and compliance over time.
CloudFormation to deploy stacks across accounts and Regions.
Trusted Advisor to get insights, and a Support Plan adapted to your needs.
Send Service Logs and Access Logs to S3 or CloudWatch Logs.
CloudTrail to record API calls made within your account.
If your account is compromised: change the root password, delete and rotate all passwords / keys, and contact AWS support.
Allow users to create pre-defined stacks defined by admins using AWS Service Catalog.

Quick recap

Concept	What to remember for the exam
AWS Organizations	Global; master account; Consolidated Billing, volume discounts, RI pooling; account-creation API
Service Control Policies	OU/account level; not the Master Account; not service-linked roles; needs explicit Allow
Consolidated Billing	Combined Usage + One Bill; management account can turn off RI discount sharing
AWS Control Tower	Multi-account set-up with guardrails, runs on top of AWS Organizations
AWS RAM	Share Aurora, VPC subnets, Transit Gateway, Route 53, Dedicated Hosts across accounts
AWS Service Catalog	Admin-defined CloudFormation products in portfolios; self-service, compliant launches
Pricing models	Pay as you go · Save when you reserve · Pay less by using more · Pay less as AWS grows
EC2 purchase options	Reserved ≈ 75% off · Spot ≈ 90% off · On-demand per second (Linux/Windows)
Savings Plans	EC2 SP up to 72% (family + Region); Compute SP up to 66% (EC2, Fargate, Lambda)
Networking cost	Inbound free · same AZ + private IP cheapest · cross-AZ public IP and inter-region $0.02/GB
Compute Optimizer	ML right-sizing for EC2, ASGs, EBS, Lambda; up to 25% savings; export to S3
Pricing Calculator	Estimate costs before building
Cost Allocation Tags	`aws:` generated vs `user:` defined; feed detailed billing reports
Cost and Usage Report	Most comprehensive dataset; hourly/daily line items; Athena, Redshift, QuickSight
Cost Explorer	Visualize, resource-level granularity, choose Savings Plans, forecast 12 months
Billing Alarms	CloudWatch us-east-1, actual worldwide cost only, simple
AWS Budgets	Usage / Cost / Reservation / Savings Plans; 5 SNS notifications; same filters as Cost Explorer
Cost Anomaly Detection	ML, no thresholds to define, root-cause analysis, SNS alerts
Service Quotas	Alerts near a quota threshold; request increases
Trusted Advisor	6 categories; 7 core checks on Basic; full checks + Support API on Business/Enterprise
Support plans	Basic free · Developer email/business hours · Business 24/7 + full Trusted Advisor · On-Ramp pool of TAMs, 30 min · Enterprise designated TAM, 15 min