Management account, member accounts, payer
An AWS Organization has one management account and any number of member accounts. Consolidated billing means the management account pays for all members and receives one bill. AWS calls the management account the payer. Members keep their own account IDs, IAM users and roles, resources, regions and service quotas.
Two things pool across the Organization: volume tiers and commitments. Data transfer and S3 tiers are calculated on the combined usage, so members reach the cheaper tiers sooner. Savings Plans and Reserved Instances bought by the payer apply to matching usage in any member account, unless sharing is turned off.
What the payer can and cannot do
| Payer can | Payer cannot (by default) |
|---|---|
| See the bill, cost and usage reports for all members | Log into member accounts |
| Apply Savings Plans and Reserved Instances across members | Read or change resources in member accounts |
| Set service control policies if the feature is enabled | See data inside S3, RDS or anything else |
| Invite and remove member accounts | Take an account out without the member's consent |
Service control policies
An Organization with all features enabled can attach service control policies that limit what member accounts may do. A billing-only broker should never attach one. Deplium's Organization does not use SCPs; ask any broker for the same commitment in writing.
Enterprise Support without the minimum
AWS Enterprise Support is priced as a percentage of monthly spend with a floor of fifteen thousand dollars a month, which is more than most teams' whole AWS bill. Support is attached to the payer, and AWS extends the payer's support plan to member accounts in the same Organization. A broker with Enterprise Support on its payer can therefore open Enterprise-priority cases about your usage, with a technical account manager involved, at no extra cost to you.
What changes on the day you join
- 1You receive an invitation from the broker's management account and accept it in the AWS console of each account you want to move. Nothing else is required from your side.
- 2From the next billing cycle, AWS bills the payer for your usage. Your account shows usage but no longer generates an invoice to your card.
- 3Cost allocation tags you already use keep working. The payer's cost reports can be filtered by your account ID and tags.
- 4Any Savings Plans or Reserved Instances you bought yourself remain yours and keep applying to your usage first.
- 5You keep the root credentials, IAM, MFA and every resource. The only new relationship is a line in the console that says which Organization you belong to.
Leaving
A member account can leave an Organization at any time from its own console, provided it has a payment method and the required account information filled in. Billing returns to standalone from the moment it leaves. A good broker aligns this with the end of a billing month so the last statement is clean, and confirms that no discounts were mid-application.
Things to agree before you accept the invitation
- The rate: which percentage of list you pay per usage type, and how the broker's share is shown.
- Existing commitments: what happens to your own Savings Plans and any AWS credits on the account.
- Marketplace subscriptions: these are billed through the payer too; confirm they are passed through at cost.
- Support: which severity levels the broker will escalate to AWS Enterprise Support, and how fast.
- Exit: the notice period and that the broker will never attach service control policies to your account.
How Deplium runs its payer account
Deplium's AWS package moves your accounts under a consolidated billing family with no service control policies, applies pooled Savings Plans and Enterprise Discount Program terms, and gives the Desk Enterprise Support escalation for your incidents. Typical savings run 10 to 22 percent below list depending on your compute share. Existing Savings Plans are honoured and listed on your first statement.
Common questions
Can the payer see my data in S3 or my databases?
No. Consolidated billing gives the payer cost and usage data, not access to resources. Only IAM principals in your account can read your data.
Do I lose the AWS free tier or credits?
Credits stay with the account they were granted to and are applied first. Free-tier usage is calculated per Organization, so it may be shared across members.
Can I have accounts in two Organizations?
An account can belong to only one Organization at a time. You can move some accounts to the broker's Organization and keep others standalone.