Billing, AWS Organizations and Cost Governance

Money is where cloud exams get personal. Domain 4 (Billing, Pricing, and Support, 12% of scored content) carries roughly six scored questions, and Task Statement 4.2: "Understand resources for billing, budget, and cost management": owns most of the ones in this lesson: billing support and information, AWS Organizations, cost allocation tags, and the "appropriate uses and capabilities of AWS Budgets and AWS Cost Explorer" plus "consolidated billing and allocation of costs". The pattern of failure is always the same: candidates know the services but not which page answers which question, and they fall for the two traps AWS reuses endlessly: "an SCP grants access" and "the bill follows the OU tree". Neither is true.

In this lesson you will:

• open the Billing and Cost Management console and name the exact page for every common money question;
• build AWS Organizations: one root, up to five OU levels, management account as payer, member accounts as users;
• explain consolidated billing: one bill per seller of record, no extra fee, pooled volume discounts, shared RI/SP discounts;
• compute a consolidated volume-discount example and an RI-sharing blended-rate example from scratch;
• separate blended from unblended costs and say exactly who sees which;
• separate SCPs from IAM: deny-only, intersection, management-account immunity;
• activate cost allocation tags (AWS-generated vs user-defined) and run a showback → chargeback flow;
• choose between Budgets, Cost Explorer, CUR, Pricing Calculator and anomaly detection: including what each one costs;
• read RI/SP reservation, utilization and coverage reports and diagnose over-buying vs under-buying;
• navigate AWS Marketplace: consolidated billing of third-party purchases, private offers and Private Marketplace;
• handle invoices, currencies and payment basics, and know that billing support is free for everyone;
• practise with 12 exam-style questions plus four interactive checks.

---

1. The Billing and Cost Management console: one console, many pages

1.1 The Bills page: the invoice view

The Bills page is the canonical "where is my invoice?" answer. Its contents are fixed and examinable:

AWS states it directly: "If you use the consolidated billing feature in AWS Organizations, the Bills page lists totals for all accounts on the Charges by account tab." (as of Oct 2026)

1.2 The billing dashboard Home: the exploratory view

The Home dashboard is Cost Explorer-backed and is where slicing happens. Its widgets group spend by Service · AWS Region · Member account (management account only) · Cost allocation tag · Cost category. Three behaviours matter on exam day:

• merely visiting the page auto-enables Cost Explorer (there is no API way to enable it later);
• the cost summary excludes credits and refunds: a number on Home can legitimately differ from the bill;
• data refreshes at least every 24 hours.

• 📚 Did you know? Billing help is not a paid extra: AWS's Knowledge Center states "All AWS account owners have access to account and billing support free of charge": every plan, including Basic. That is why "you must upgrade your support plan to ask a billing question" is a dependable wrong answer (as of Oct 2026).

---

2. AWS Organizations: roots, OUs and who the payer is

2.1 The structure

An organization is a tree, and the tree has hard rules:

• one root per organization;
• nested organizational units (OUs) up to five levels deep (verify current before use);
• accounts attached to the root or to an OU: accounts are the leaves where resources actually run;
• the management account is the payer, and AWS says it is responsible for "all usage, data, and resources used by the accounts in the organization";
• AWS Organizations is offered at no additional charge, and consolidated billing adds no extra fee (as of Oct 2026).

2.2 Management account vs member account

2.3 Two feature sets, and what a billing-only organization cannot do

Organizations ships in two feature sets, and the difference is exam gold:

In a billing-only organization, members remain "otherwise independent": each can sign up for services and use Premium Support independently. That is why a question describing "members sign up freely, no guardrails, but one combined bill" is describing the consolidated-billing-only feature set.

• 📚 Did you know? AWS warns that "Your bill will not reflect the structure that you have defined in your organization": the OU tree is a governance device, not a billing dimension. If a question asks you to bill the data OU separately, the answer is activated cost allocation tags (or cost categories), never "create another OU" (as of Oct 2026).

---

3. Consolidated billing: one payment, pooled usage, shared discounts

3.1 The four documented benefits

3.2 Tier thresholds are pooled, not per-account

The single most testable sentence in this topic: "AWS treats all accounts in an organization as a single account. Member accounts don't reach tier thresholds individually." Aggregation is per service, every month starts at zero, and leftover capacity from one account (RI hours, tier progress) can be used by another.

Worked Example E1: AWS's published 95 TB tier illustration (tier table is AWS's published S3 Standard pricing: $0.10/GB first 1,000 GB, $0.08/GB next 49,000 GB, $0.06/GB thereafter; as of Oct 2026, verify current before use)

Three member accounts each store about 31,667 GB in the same month (3 × 31,667 ≈ 95,000 GB = 95 TB; the even split shown is illustrative: AWS publishes the two totals, $6,720 pooled versus $7,660 separate):

No account reached 1,000 GB alone, yet the org crossed three thresholds: exactly what "member accounts don't reach tier thresholds individually" means.

Worked Example E2: two accounts, and the blended rate written back (tiers as above; arithmetic worked here)

Account A stores 900 GB, Account B stores 600 GB:

• Standalone: A = 900 × $0.10 = $90.00; B = 600 × $0.10 = $60.00 → $150.00
• Pooled: 1,500 GB → first 1,000 × $0.10 = $100.00, remaining 500 × $0.08 = $40.00 → $140.00
• Saving: $10.00 (6.67%)
• Blended allocation rate: $140.00 ÷ 1,500 GB = $0.0933333/GB
• A's allocated share: 900 × 0.0933333 = $84.00 (saves $6.00) · B's: 600 × 0.0933333 = $56.00 (saves $4.00) · check: 84 + 56 = $140.00 ✓

3.3 Blended vs unblended: the trap that never dies

• Blended rates average the Reserved Instance and On-Demand rates across member accounts; EC2 blended rates are computed hourly. The allocation order is RI hours → free-tier hours → On-Demand hours.
• Unblended is what each member account is shown: AWS states "AWS shows each member account their charges as unblended costs."
• In the Cost and Usage Report, lineItem/BlendedRate is computed at the management account so the org can allocate cost back down.

3.4 Support is never pooled

Consolidated billing does not merge support: "AWS calculates Support fees independently for each member account … Each account subscribes independently." Enterprise customers may opt into aggregated monthly billing of support fees, that is billing aggregation, not pooled entitlements. Developer, Business and Enterprise plans each carry a monthly minimum (as of Oct 2026; plan names are in flux, see Section 9.3).

---

4. Reserved Instances and Savings Plans across accounts

4.1 The sharing rules

Two boundaries to memorise: sharing can be switched off in Billing preferences (the RI/SP sharing toggles), and neither instrument crosses an organization boundary: an RI bought in Organization 1 never discounts Organization 2.

Worked Example E3: an RI bought by one team saves another (AWS's published blended-rate example, trimmed to two accounts; as of Oct 2026)

A 30-day month = 720 hours; t2.small in one AZ; On-Demand rate $0.023/h. The org owns 2 Full Upfront RIs (1,440 h capacity) and 1 Partial Upfront RI (720 h).

Account 2 bought nothing yet its blended share is $4.14 instead of $16.56; it rode on Account 1's reservations because the org is treated as one account. Its unblended line still reads $16.56.

• 📚 Did you know? RI and Savings Plans sharing is a preference, not an inevitability: the Billing preferences page carries the RI/SP sharing toggles, so "sharing cannot be disabled" is itself a wrong answer. The exam habit to build: whenever an answer says "never", "always" or "cannot be disabled", look for the toggle AWS documents (as of Oct 2026).

---

5. SCPs vs IAM: the deny-only ceiling

5.1 What an SCP is, and what it is not

A Service Control Policy is an Organizations guardrail attached at the root or an OU, and it applies to every member account beneath it. AWS's definition is one sentence long and half the exam hangs on it: "SCPs do not grant permissions", and they provide "central control over the maximum available permissions": a ceiling, never a floor. Two footnotes worth memorising: SCPs do bind a member account's root user, and they have no effect on service-linked roles.

Worked Example E4: the two classic SCP stems (rule logic, not pricing)

1. "Stop member accounts from launching instances outside approved Regions, without touching anything else they may do." → attach a deny-only SCP at the OU. You removed a permission; you granted nothing, and it works only if the org is on the all features set.
2. "Give the data team permission to read the shared bucket." → an IAM policy (or a resource policy). An SCP cannot do this, because an SCP that says Allow on s3:GetObject changes nothing: the intersection still needs an IAM Allow underneath.

---

6. Tagging and cost allocation tags: showback and chargeback

6.1 Two kinds of tag, one activation rule each

A tag is a key (with an optional value) attached to a resource; each key is unique per resource. For billing, AWS splits tags into exactly two kinds:

Three rules decide whether your tag ever reaches a report:

1. You must activate both kinds separately: "You must activate both types of tags separately before they can appear in Cost Explorer or on a cost allocation report."
2. Activation lives in the management account (or a standalone account): member accounts cannot activate cost allocation tags.
3. Allow up to 24 hours for activated tags to start flowing (verify current before use).

Worked Example E5: "we tagged everything and the report is empty" (diagnostic sequence)

6.2 What the cost allocation report can and cannot split

The report is a CSV grouped by active tags, including explicit tagged and untagged rows, and its month-end totals reconcile with the Bills page. It cannot allocate:

• resources created mid-month before tagging started;
• untagged resources and non-tagging services;
• "Subscription-based charges, such as AWS Support and AWS Marketplace monthly fees, can't be allocated".

Cost categories, rules-based mappings you define, sit alongside tags as a dimension in Cost Explorer, Budgets and the Bills page, which is the escape hatch when a charge type cannot be tagged.

6.3 Showback vs chargeback

Worked Example E6, a two-team split (illustrative figures, the flow is sourced, the amounts are made up for practice)

Showback stops here (no payment). Chargeback continues: finance debits each team $39,000 / $21,000 through internal accounting: the difference between the two is whether someone is expected to pay.

• 📚 Did you know? AWS-generated tags can be created by a third party: AWS's cost-allocation documentation counts tags "defined and applied by AWS or an AWS Marketplace ISV" as AWS-generated. So a Marketplace vendor's tag can appear in your cost data before you write a single line of tagging policy; you still have to activate it separately from your own (as of Oct 2026).

---

7. Cost management: Budgets, Cost Explorer, RI/SP reports and the CUR

7.1 AWS Budgets: alert first, act second

AWS Budgets monitors a target and notifies you. The documented facts:

Budget actions are what separate an alert from a control: they run "programmatically or with your approval" and can apply IAM policies, SCPs, or AWS resources, integrating with AWS Chatbot (Slack/Chime) and Service Catalog. AWS's own setup example is the one to memorise: notify at 80 percent of the budgeted amount and apply an action: for example a custom IAM policy that denies provisioning additional resources.

Worked Example E7: budget arithmetic with an action (AWS's documented 80% pattern; amounts illustrative)

7.2 Cost Explorer: explore, group, filter, forecast

Worked Example E8: what "free" Cost Explorer really costs (official rate card; arithmetic here)

• A script calls the Cost Explorer API 5,000 times in a month: 5,000 × $0.01 = $50.00.
• A team switches on hourly granularity for 10,000 usage records for one day: 10,000 × $0.00000033 = $0.0033; over 30 days ≈ $0.10; which is why the docs' shorthand is "about $0.01 per 1,000 records per month".
• Console clicks in the default (daily) view: $0: monitoring your dashboard is not an API call.

7.3 Reservation, utilization and coverage: three different questions

Worked Example E9: utilization 98% vs coverage 90% (AWS's published Savings Plans examples; as of Oct 2026)

• Utilization: a $10/hour commitment with usage billed at Savings Plans rates totalling $9.80 → $9.80 ÷$10.00 = 98% utilized. Two percent of what you paid for went unused; you are close to over-buying.
• Coverage: 9 of 10 identical instances costing $1.00/hour run on Savings Plans rates → covered $9.00 of $10.00 = 90% covered: one instance-hour is still billed at On-Demand, so you are under-buying.
• Reports use normalized units so different instance sizes compare fairly.

7.4 The Cost and Usage Report (CUR)

The CUR is the raw export: line items delivered to your own S3 bucket at least once per day, at hourly, daily or monthly granularity, in CSV or Parquet. It carries both lineItem/UnblendedRate and lineItem/BlendedRate, the latter computed at the management account, which is why the CUR is the tool for chargeback-grade allocation, while Cost Explorer is the tool for exploration.

7.5 Awareness items (not on the official in-scope service list)

Two real console features are not named in the CLF-C02 in-scope list: treat them as bonus awareness and never as the keyed answer when Budgets or Cost Explorer also fits:

And the reverse trap: AWS Billing Conductor is explicitly out of scope for this exam, as are Amazon DevPay and AWS Application Cost Profiler: an option naming Billing Conductor is a distractor.

• 📚 Did you know? Cost Explorer is deliberately hard to get rid of: AWS lets you enable it only from the console ("You can't enable Cost Explorer using the API"), gives you 12 months of history plus a 12-month forecast the moment you enable it, and then you cannot disable it. AWS is charging for programmatic access ($0.01 per API request) and hourly granularity (about $0.01 per 1,000 records per month): reading the dashboard stays free, automating it is metered (as of Oct 2026).

---

8. AWS Marketplace: buy third-party, pay AWS

8.1 What it is and how it bills

AWS defines Marketplace as "a curated digital catalog that customers can use to find, buy, deploy, and manage third-party software, data, and services": available product types include SaaS, AMIs, containers, CloudFormation templates, SageMaker offerings and data products.

• 📚 Did you know? Marketplace rides your existing bill, but its monthly fees cannot be tag-allocated, so a chargeback model must handle Marketplace subscriptions through an agreed rule or a cost category rather than through tags (as of Oct 2026).

---

9. Invoices, currencies, payment basics, and who to ask

9.1 What is verified about currency and invoices

9.2 Where you change things

9.3 Support-plan cross-references (from the support lesson)

Four facts from Domain 4 task 4.3 that belong in a billing answer:

1. Billing/account support is free on every plan: "All AWS account owners have access to account and billing support free of charge."
2. Basic Support cannot open technical cases, but it can open account and billing cases and service-limit increase cases (24×7).
3. Support is per account, not per organization: "Each account subscribes independently"; Enterprise may opt into aggregated monthly billing of support fees only.
4. Where to ask what: how do I tag 400 instances? → AWS re:Post (AWS-managed community + Knowledge Center, "over 4,000" official articles and videos): not for time-sensitive or account-specific questions; invoice does not match my estimate → Support Center account-and-billing case; someone is reselling our stolen image → AWS Trust and Safety team.

Current plan lineup as of Oct 2026 (verify names before exam day):

• Basic
• Business Support+
• Enterprise
• Unified Operations

Developer and Business stopped new subscriptions 2 December 2025 and are discontinued 1 January 2027, as is Enterprise On-Ramp; which is supported only through 31 December 2026. Plan names are the single churniest fact in Domain 4, so re-check the support lesson before exam day.

---

10. One-minute decision drill

---

Real-World Case Studies

Sections 1 to 10 teach the tools; these five AWS-published stories show the tools against real bills. Every figure below is a customer result that AWS itself published (official case-study pages accessed 2026-10): none of them is an AWS guarantee, and none of them is a memorisable exam number. What transfers to exam day is the lever: which charge type, which pricing model, which governance mechanism actually moved.

Case 1, Box: $2.23 M from architecture, not from a discount code

Challenge: cut spend without weakening security, reliability or performance. Services: Well-Architected Framework with Solutions Architect reviews, S3/S3 Glacier storage tiering, EBS volume-and-snapshot hygiene, CloudTrail event filtering, and routing traffic around internet gateways.

What AWS published: $2.23 million unpacked into four charge types:

Customer voice: Clay Alvord, director of FinOps and SRE: "Our use of AWS best practices led to savings of over 2 million dollars, setting a new baseline…"

Exam link: not one dollar came from a discount code or from Organizations. Three of the four levers are architecture and hygiene, which is why AWS frames cost optimisation as the Well-Architected cost pillar; the fourth (storage) is a tiering/purchasing decision. This lesson connects at both ends: activated cost allocation tags and Cost Explorer/CUR (Sections 6 to 7) are what show you that inter-AZ transfer and log volume are ballooning, but only a redesign removes the charge.

Figures exactly as AWS publishes them: egress ("over $1.1 million per year") and storage ("over $500,000") are floors; inter-AZ $438,000 and logging $192,000 are exact: as of Oct 2026.

Case 2, Canva: the pricing-model ladder as a business

Challenge: cost-effective scale with reliability tiers per user plan. Services: Spot for free-tier projects, On-Demand + Savings Plans for paying Pro users, Reserved Instances as a fallback, plus AWS cost tooling.

What AWS published: compute costs reduced by 46 percent in less than 2 years, and the case study quotes AWS's own list claims alongside it: RIs "a discount of up to 72 percent compared to On-Demand", Savings Plans "up to 72 percent … in exchange for a 1- or 3-year hourly spend commitment", Spot "up to 90 percent discount" (as of Oct 2026; verify current before use).

Exam link: this is Section 4 turned into a plan: steady baseline → Savings Plans (flexible $/hour commitment), steady family/AZ-pinned work → Reserved Instances, interruptible spare capacity → Spot. Two habits to keep: commitment discounts are always "up to" percentages, never guaranteed, and the cheapest tier of an application is exactly what Spot is for.

Case 3, FarEye: three levers in one bill

Challenge: thin last-mile logistics margins and a need for predictable spend. Services: Compute Savings Plans, EC2 Spot, and Graviton across 500+ Spot/On-Demand instances.

What AWS published: AWS compute costs reduced by 65 percent, $1 million per year in cloud cost savings, and +30 percent performance from Graviton.

Exam link: predictable spend is the Section 7.1 story: a company that must forecast to the dollar runs thresholds and budget actions, not month-end surprises; and the discount ladder it climbed (Savings Plans → Spot → Graviton price-performance) is the same ladder Canva climbed in Case 2.

Case 4, athenahealth: governance across 120 accounts

Challenge: monitor egress across a sprawling VPC estate while inspection costs climbed, with a small team. Services: centralized AWS Network Firewall, Transit Gateway, AWS RAM for policy fan-out, CloudFormation rules-as-code, Direct Connect.

What AWS published: inspection costs reduced by 95 percent; hundreds of VPCs across 120 accounts added "within just a few days"; eight people designed and rolled out the new security design with no disruptions.

Exam link: 120 accounts is only operable because of AWS Organizations (Section 2: one root, OUs five levels deep, the management account as payer) plus sharing mechanisms such as AWS RAM; the deny-only SCP ceiling of Section 5 is what keeps member accounts inside the guardrails while one central firewall does the inspection. The cost lesson mirrors Section 6: centralise once, allocate many: one inspection layer billed once beats 120 copies, and the money shows up first in the management account's Charges by account view.

Case 5, Shutterfly: right-sizing and licence avoidance

Challenge: on-premises VMware, stand-alone stacks, 2,000+ VMs and a colocation exit. Services: VMware Cloud on AWS as a bridge (August 2022), then native migration completed March 2025, six months early, roughly 800 systems and 400 TB, about 80% of workloads on ECS.

What AWS published: VM footprint 2,000 → 1,200, and an approximately 25% opex cut from licence avoidance plus right-sizing.

Exam link: right-sizing is the free lever; it is what Cost Explorer recommendations, Cost Optimization Hub (Section 7.5) and a Well-Architected cost review exist to find, and utilization-vs-coverage (Section 7.3) is how you prove you stopped over-buying; licence avoidance is the classic on-premises → cloud TCO argument (Domain 1) landing in a Domain 4 bill.

• 📚 Did you know? AWS's Box write-up is signed by the customer's director of FinOps and SRE, not by AWS, and our 2026-10 research digest found the same pattern across the whole case-study library (roughly 95% of pull-quotes are customer staff, not AWS executives). Read every saving as "the customer achieved", never as "AWS guarantees". Two of the stories here are also multi-account stories by design: athenahealth's 120 accounts and Shutterfly's separate SBS estate both depend on Organizations-style structure before any cost tool can aggregate a thing.

---

2026 Updates (as of October 2026)

Money facts move faster than the exam guide. Everything below comes from our October 2026 research pass: only what AWS published is stated; nothing unverifiable is asserted.

• 📚 Did you know? The Free Tier itself changed on 2025-07-15: accounts created on or after that date get 6 months (or until credits run out) plus a USD 100 sign-up credit and up to USD 100 earnable = up to USD 200, while older accounts keep the legacy 12-month, t2.micro-based tier, and t2.micro/t3.micro gave way to t3.micro, t3.small, t4g.micro, t4g.small, c7i-flex.large, m7i-flex.large. Both behaviours are correct AWS behaviour; the trap is assuming one universal rule (as of Oct 2026; verify current before use).

---

Practice Questions

---