Centralising the cloud bill does not require putting every workload in one account. In AWS Organizations, the management account pays member-account charges through consolidated billing, while cost reports remain available for each member account. You can separate workloads without giving up central payment.
Before approving an AWS account structure, settle three decisions: who controls the organisation, which operations need a boundary, and who pays and reviews the costs. Ask your technical team or agency to make each responsibility explicit. An account diagram is only part of that answer.
Three decisions to make separately
When someone proposes “separate accounts”, ask which problem the separation should solve. Use these three layers to frame the approval, and name an accountable owner for each. The same person may own more than one layer; the responsibilities should still be distinct.
Assign authority over organisational changes, access and recovery.
Agree how production, non-production and workloads should be managed.
Assign payment responsibility and ownership of cost review.
Use each layer as a separate approval decision.
Decide control, operational boundaries and cost responsibility separately.Keep organisational control separate from workloads
AWS recommends restricting management-account access to administrators who need to change the organisation and avoiding workloads in that account. Reserve it for organisational control, with the applications and services that run the business in member accounts.
AWS also recommends an administrative user rather than the root user for everyday tasks and requires multi-factor authentication (MFA) registration for the organisation’s management-account root user. Routine administration should not depend on root access.
For business continuity, retain a named internal owner even when an agency manages the infrastructure. Require the owner to establish who can authorise organisational changes and have the technical team validate how the business would regain access if its usual administrator were unavailable.
Give each environment boundary a purpose
AWS’s March 2022 Well-Architected guidance, an earlier Framework version, describes separate member accounts by organisational unit, environment lifecycle or workload as common practices. Development, testing and production are examples, not a mandatory template. The guidance explicitly rejects a universal account count and asks organisations to consider current and future operational and cost models.
A practical starting point is to examine production and non-production. Ask the technical owner to explain which activities need separate administration, who should approve changes and what another account would achieve. Require a clear purpose and an operating owner before approving the addition.
Do not accept an account boundary or an environment label as proof of complete isolation. Make technical review of access and network policies, deployment roles, secrets and data handling a separate approval requirement. Ask for an explanation of the intended separation and how it will be verified.
Separate cost responsibility from payment
AWS Organizations consolidated billing puts payment responsibility for member-account charges in the management account. Member-account cost reports remain available, and member-account bills are informational. This supports central payment with account-level review, not an assumption of separate payable invoices.
Assign a cost-review owner to each workload account, even when finance handles payment. Give that owner responsibility for explaining expenditure and escalating changes. If account-level reporting is too broad for your decisions, ask finance and the technical team to validate a finer allocation approach, including any proposed cost tags.
Resolve invoice, payment-method, legal-entity and tax requirements separately with finance. For any proposed budgets or alerts, require the team to confirm what happens when a threshold is reached and who responds. Do not approve the arrangement on an assumption that an alert guarantees spending will stop.
Choose a proportionate starting structure
The recommended starting design is a controlled management account, workloads in member accounts and further boundaries where operating or cost needs justify them. Apply the earlier AWS guidance’s current-and-future test, but do not build every anticipated boundary immediately.
Restrict access and keep workloads elsewhere.
Document the environment or workload purpose and its owner.
Use member-account reports and assign cost-review owners.
Reconsider when operating or cost needs change.
An editorial decision framework informed by AWS guidance, not a prescribed account count.
Test the proposed structure against these approval criteria.Record each account’s purpose, operating owner and cost-review owner. Revisit your AWS account structure when those responsibilities or workload needs change. If the proposed design differs from where live workloads run today, commission a separate migration assessment before approving a move.
Verify ownership before the next vendor or deployment
Request a short ownership record with supporting checks. Start with the AWS guidance above:
- Management-account access: identify the administrators who need authority to change the organisation.
- Root and everyday access: verify management-account root MFA and use of a non-root administrative user for routine tasks.
- Workload placement: confirm that workloads are outside the management account.
- Billing visibility: confirm the management account’s payment responsibility and access to member-account cost reports.
Then add the following recommended operating-policy checks. Have the responsible teams validate the arrangements; these are not an end-to-end AWS configuration procedure.
- Company control: name the accountable internal owner and validate company-controlled email, recovery and emergency access.
- Individual access: agree named single sign-on (SSO) access with MFA and a policy against routine shared administrator credentials.
- Environment ownership: record each account’s purpose, intended production and non-production boundaries, and who verifies the relevant controls.
- Cost accountability: name who handles payment, reviews each account’s costs and responds to cost concerns.
- Agency departure: require an access inventory, an internal authoriser and a validated offboarding process covering access removal and continuity of company control.
Give one ongoing owner responsibility for keeping this record current. Turn any unresolved recovery or vendor-access issue into an assigned action with a completion date, rather than accepting it as an undocumented dependency.
Can you name who controls your organisation, what separates production from non-production, and who reviews the cost of each?
