AWS Organizations & consolidated billing: SAA-C03

AWS Organizations with consolidated billing rolls every member account's charges into one bill paid by the management (payer) account, while each team keeps working in its own isolated account. Why not the others: merging into one account destroys the account boundary teams rely on and is a large migration; reconciling 14 separate invoices is the manual toil consolidated billing removes; and collapsing everything into the payer account both loses isolation and makes that account a blast-radius risk. One payer, many member accounts, one bill — that is the pattern.

Under consolidated billing, AWS treats the organization's usage as if it came from one account for tiered services, so the combined volume crosses lower-price tiers faster than any account would alone — a real discount with no workload change. Why not the others: threshold aggregation is exactly what consolidated billing adds, so 'each account independently' is wrong; more accounts do not multiply the Free Tier, which applies once across the organization; and consolidating storage into the payer account is unnecessary because usage already pools for pricing. Combined usage, faster tiers.

By default, consolidated billing shares Reserved Instance and Savings Plans discounts across the Organization: unused reservation hours in one account are applied to matching usage anywhere in the family, so the commitment is not wasted. Why not the others: discounts do leave the purchasing account under default sharing; the second account does not need to buy its own reservation to benefit; and nothing is manually transferred — the billing system matches usage automatically. Shared commitment discounts are a core reason multi-account customers adopt Organizations.

A Service Control Policy is a guardrail: it defines the ceiling of what identities in an account may do, so denying every Region except eu-central-1 blocks out-of-Region launches — but the SCP grants nothing; IAM policies inside the account still grant the actual permissions. Why not the others: an SCP never grants, it only limits the maximum; SCPs do not restrict the management account, which is why you keep workloads out of it; and SCPs sit alongside IAM as an outer boundary, they do not replace per-account IAM policies. Limit, don't grant — the exam tests this exact wording.

Organizational units group accounts so a policy attached to the OU applies to exactly the accounts inside it — put the sandbox and dev accounts in one OU, attach the SCP there, and production is untouched. Why not the others: attaching at the root would hit production too, which the requirement forbids; hand-attaching to each account is the manual drift OUs exist to prevent; and adding IAM policies in production accounts targets the wrong accounts and misses the guardrail intent. OUs are how you apply policy to a subset of the Organization at scale.

Consolidated billing keeps the single payer and one invoice, while cost allocation tags (and per-account grouping) attribute charges to each team for accurate chargeback — you keep the volume and commitment-sharing benefits and still see who spent what. Why not the others: separate standalone accounts with separate bills throw away the shared volume tiers and RI/SP discounts; dividing the bill evenly is not real attribution; and turning off consolidated billing sacrifices every combined-usage benefit just to get separate invoices you did not need. One payer plus tags gives chargeback without giving up the discounts.

Discount sharing is on by default but configurable: the management account can turn off Reserved Instance and Savings Plans discount sharing for specific accounts, so a team's reservations apply only to its own usage. Why not the others: sharing is not permanently fixed — that is the whole point of the setting; removing the account from the Organization loses consolidated billing and every other benefit just to isolate one reservation; and purchasing from the payer account would spread the discount even more widely, the opposite of what the team asked. Sharing is the default, but it can be scoped per account.