AWS Organizations and billing alerts setup

Overview

AWS Organizations gives consolidated billing, SCP guardrails, and OU structure. Set it up early; retrofitting is painful when prod accounts have drifted.

Core steps

1. Create organization root; enable all features so SCPs apply.
2. Structure OUs: Security, Infrastructure, Workloads (or Sandbox / NonProd / Prod). Move accounts only after change windows.
3. Delegate AWS Organizations trusted access for security tooling (GuardDuty, Security Hub) from a dedicated security account where possible.
4. Consolidated billing: billing alerts on the payer account at 50/75/90% of forecast; Cost Anomaly Detection on for payer.

Guardrails

Start with deny list SCPs for restricted regions or high-risk APIs in non-prod OUs; document exceptions. Use AWS Config aggregator in the audit account for multi-account compliance dashboards.

Client conversation

Explain that alerts reduce invoice shock and that tags drive chargeback—finance needs a naming standard before engineers spray resources.