Multi-account & cost · Prasanta Kumar Behera

Structure AWS for many teams: accounts as isolation boundaries, Organizations and SCP guard-rails, a landing zone, and FinOps basics (tagging, budgets, commitments, Spot and the hidden costs of data transfer).

Accounts are the boundary

In AWS, an account is the strongest isolation unit: separate IAM, separate resource limits, separate blast radius, separate bill. Mature setups use many accounts, organised in AWS Organizations:

Management account (billing, Organizations only — no workloads)
├── Security OU:        log-archive, security-tooling
├── Infrastructure OU:  network (Transit Gateway, egress), shared-services
├── Workloads OU
│   ├── Prod OU:        shop-prod, payments-prod
│   └── NonProd OU:     shop-dev, shop-staging, payments-dev
└── Sandbox OU:         per-engineer sandboxes (budgets + auto-cleanup)

A big company doesn't put every department in one room. Each team gets its own office (account) with its own keys and electricity meter. Head office rules (SCPs) apply to every office: "no fires, no smoking, lights off at night". And the finance team reads every office's meter (cost reports) to see who's using what.

Guard-rails with SCPs

SCPs set the maximum for everything in an OU or account, including admins. Common ones:

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Sid": "ProtectAuditAndDetection",
      "Effect": "Deny",
      "Action": [
        "cloudtrail:StopLogging", "cloudtrail:DeleteTrail",
        "guardduty:DeleteDetector", "config:StopConfigurationRecorder",
        "organizations:LeaveOrganization"
      ],
      "Resource": "*"
    }
  ]
}

Plus region restrictions (lesson 01) and, for sandboxes, denies on expensive services.

Landing zone and identity

AWS Control Tower (or a Terraform-based equivalent) sets up the multi-account structure, baseline logging and guard-rails, and "vends" new accounts consistently.
IAM Identity Center gives people SSO into each account with permission sets mapped from IdP groups, with no IAM users.
A log-archive account receives CloudTrail and Config from every account; a security account runs GuardDuty and Security Hub as delegated administrator.

FinOps basics

1. Visibility. Enforce a minimal tag set (Owner, Environment, CostCenter, Application) with tag policies and IaC; activate tags as cost allocation tags; review Cost Explorer by account, service and tag.

2. Alerts. AWS Budgets per account and team, with alerts at 50/80/100% and forecasted overspend. Anomaly detection catches sudden jumps.

3. Pay less for the same thing.

Lever	When
Right-sizing	First: most instances and Kubernetes requests are oversized
Savings Plans / Reserved Instances	For steady baseline usage (1- or 3-year commitments)
Spot	Interruptible workloads (CI, batch, stateless replicas)
Graviton	Often better price-performance
gp3 over gp2, lifecycle rules for S3/logs	Storage waste

4. Watch the hidden costs. NAT Gateway data processing, cross-AZ and cross-region transfer, internet egress, idle load balancers, unattached EBS volumes, old snapshots, forgotten Elastic IPs.

For Kubernetes, allocate cost to namespaces and teams with tools such as OpenCost/Kubecost, and remember that idle requested capacity costs the same as used capacity (see Kubernetes Administration, lesson 23).

Try it: design, then look at real numbers

Draw an account structure for your organisation (or the fictional Northwind from Kubernetes Administration, lesson 32): OUs, accounts, and who logs in where.
Write two SCPs: region restriction and audit protection. Test them in a sandbox OU with the IAM policy simulator or real calls.
In any account you can see billing for, use Cost Explorer to find the top 5 services last month and the share of data transfer and NAT.
Create a monthly budget with an 80% alert to your email.
List unattached EBS volumes and unused Elastic IPs (aws ec2 describe-volumes --filters Name=status,Values=available).

Going deeper: cloud platform governance

Vend accounts through automation (Account Factory, or Terraform pipelines) with baselines applied on creation, never by hand.
Make cost a shared metric: showback or chargeback per team, reviewed monthly, with engineering owning the fixes.
Tie budgets to sandboxes with automatic cleanup (e.g. nightly deletion of untagged resources) to stop forgotten experiments.
Keep the management account empty of workloads and tightly controlled; it can't be restricted by SCPs.

Recap

Accounts are the isolation boundary; Organizations + OUs structure them.
SCPs cap permissions organisation-wide; a landing zone and Identity Center make it repeatable and SSO-based.
FinOps: tags → visibility → budgets → right-size → commit (Savings Plans) → Spot/Graviton, and watch data transfer and NAT.

This site is a public version of my personal engineering knowledge hub. It intentionally excludes confidential company information and internal operational details.