The situation
A software company has nine product teams and one AWS account that everything runs in. The monthly invoice arrives as a single figure, broken down by service, and no further.
Four requests arrive in the same fortnight.
Finance has asked to charge each product team for what it uses, so that the platform’s cost appears in the right cost centre rather than as one central overhead.
A team lead overspent by about AUD$11,000 last month running an experiment they forgot to shut down. They found out five weeks later when the invoice arrived. They want to know before it happens again, not after.
Architecture is planning a new data pipeline and has been asked for a cost estimate before the build starts. Nothing exists yet to measure.
The platform lead had a production incident in which the platform was degraded for four hours. They opened a support case and got a reply the next business day. The company is on Developer Support, a plan AWS is discontinuing on 1 January 2027, and they want to know what it would take to get an engineer within the hour, and whether that is the same thing as getting a named person who knows the architecture.
Underneath it all, one account, no tagging standard, and no way to attribute anything to anyone.
What actually matters
The attribution problem comes first, because three of the four requests depend on it. Cost data can only be split along boundaries that exist in the data, and in a single untagged account there are no such boundaries. Deciding how to create them is the structural decision here: separate accounts give a hard boundary that nothing can accidentally cross, and tags give a soft one that depends on discipline. Most estates end up using both, and the choice of which does the primary attribution shapes everything downstream.
The second thing is that a tag has to be on the resource at the time the cost is incurred. An activated cost allocation tag becomes visible in billing data from the point of activation onward. A management account can request a backfill of up to twelve months, but that only reapplies the current activation status to past months, and the resource has to have carried the tag then for any value to appear. So the five weeks of history that finance would like to charge back cannot be reconstructed by tagging now. That makes tagging an urgent decision rather than a tidy one, and it argues for enforcing the standard rather than requesting it.
Third, three of the tools in this space look similar and answer questions at different points in time. One estimates a cost that does not exist yet. One analyses spend that has already happened. One watches a threshold going forward and raises an alert. Picking the wrong one produces an answer to a question nobody asked, and the AUD$11,000 experiment is a case where the second was used when the third was needed.
Fourth, an alert is not a cap. A threshold can notify, and it can trigger an action, but spending does not stop by itself when a number is reached. Designing around that distinction is what separates a control from a report.
Finally, the support question has two halves that are easy to run together: how fast somebody responds, and whether that somebody is a named person who already knows the architecture. Those are different lines on the plan comparison and they sit at different tiers.
What we’ll filter on
- Creates a boundary the cost data can actually be split along.
- Attributes spend to a team without depending on anyone remembering to do something.
- Warns before a threshold is crossed rather than after the invoice.
- Estimates a cost for something that does not exist yet.
- Gives a first response fast enough for an outage, and separately, a person who knows the estate.
The landscape
AWS Organizations groups many accounts under a management account, with organisational units in between. Billing is consolidated: one invoice covering every account, with usage combined so volume pricing, Reserved Instance and Savings Plans discounts are shared across accounts. Each member account’s spend is separately visible, which is attribution by structure rather than by convention. Service control policies cap what principals in member accounts can do, and the management account is not restricted by them.
Cost allocation tags attach key-value pairs to resources and split cost reports by them. AWS-generated tags carry an aws: prefix and cannot be edited; user-defined tags appear with a user: prefix in reports and have to be activated in the Billing console before they show up at all. They are the finer-grained tool, and they depend on resources actually being tagged, which is why tag policies standardise the keys and service control policies can require them.
AWS Cost Explorer visualises and analyses spend that has already happened, grouped by service, account, tag, Region or usage type. It covers the current month plus the last 13 months, forecasts up to 18 months ahead, and produces Reserved Instance purchase and rightsizing recommendations. The console view is free; each paginated Cost Explorer API request costs USD$0.01.
AWS Budgets sets a target for cost, usage, or the utilisation and coverage of Reserved Instances and Savings Plans, and alerts when actual or forecast figures cross it. A budget action can apply an IAM policy or a service control policy, or target specific EC2 or RDS instances, and it runs either automatically or after manual approval. Budgets data refreshes up to three times a day, so an alert follows the spend by hours rather than seconds.
AWS Pricing Calculator estimates the cost of an architecture before it is built, from a specification of the services and their sizes. It is the answer whenever nothing exists to measure.
AWS Cost and Usage Report delivers the most detailed billing data available into S3 as CSV, line by line, for analysis in Athena, Redshift or Amazon Quick Suite (the service renamed from QuickSight in October 2025). It suits chargeback models that need more than the console’s views.
AWS Cost Anomaly Detection runs machine learning models over your net unblended cost data and alerts on spend that departs from the established pattern, which catches the case nobody thought to set a budget for. It evaluates roughly three times a day, and because it reads Cost Explorer data it can take up to 24 hours to surface an anomaly.
AWS Billing Conductor produces customised billing views and rates for internal chargeback, which is the tool for showing each team a bill with the organisation’s own allocation rules applied.
AWS Support plans are now Basic, AWS Business Support+, AWS Enterprise Support and AWS Unified Operations. Developer Support, Business Support and Enterprise On-Ramp are all being discontinued on 1 January 2027, so none of them is a choice for a company deciding today; they remain available only in the AWS GovCloud (US) Region. First response on a production system down case is one hour, and that figure is the same on Business Support+, Enterprise and Unified Operations. The shorter times belong to the severity above it, business-critical system down: under 30 minutes on Business Support+, under 15 minutes on Enterprise, and five minutes from an Incident Management Engineer on Unified Operations. Business Support+ is where 24/7 phone, web and chat access to Cloud Support Engineers starts, along with more than 500 Trusted Advisor checks, the Support API and the AWS Health API. Basic gets the Service Limits checks and a selection of Security and Fault Tolerance ones. A designated Technical Account Manager comes with Enterprise.
Evaluation
Side by side
| Tool | Attributes spend | Warns in advance | Estimates the unbuilt | Enforceable without discipline |
|---|---|---|---|---|
| AWS Organizations, account per team | ✓ | ✗ | ✗ | ✓ |
| Cost allocation tags | ✓ | ✗ | ✗ | ✗ (needs a policy to enforce) |
| AWS Cost Explorer | ✓ (analysis) | ✗ | ✗ | n/a |
| AWS Budgets | ✗ | ✓ | ✗ | n/a |
| AWS Pricing Calculator | ✗ | ✗ | ✓ | n/a |
| Cost and Usage Report | ✓ (detail) | ✗ | ✗ | n/a |
| Cost Anomaly Detection | ✗ | ✓ | ✗ | ✓ |
| Billing Conductor | ✓ (chargeback view) | ✗ | ✗ | n/a |
Which tool answers which request
| Request | Timeframe | Tool |
|---|---|---|
| Charge each team for what it uses | Past and ongoing | Organizations with an account per team, plus cost allocation tags |
| Warn before overspending again | Future | AWS Budgets with alerts, plus Cost Anomaly Detection |
| Estimate the new pipeline | Before it exists | AWS Pricing Calculator |
| Understand where the money went last month | Past | AWS Cost Explorer |
| First response in an hour on a production system down | n/a | Business Support+ |
| A named person who knows the estate | n/a | Enterprise Support |
The solution
Start with the account structure, because tags alone will not hold nine teams apart. Create an AWS Organization from the existing account, which becomes the management account, and give each product team its own account under an organisational unit. Consolidated billing keeps one invoice arriving at finance while making each team’s spend separately visible with no tagging required, and it combines usage so volume pricing, Reserved Instance and Savings Plans discounts are shared across the organisation. That is attribution that cannot be forgotten, because a resource is in exactly one account.
Then add cost allocation tags for the dimensions that cut across accounts: environment, project, cost centre. Activate the user-defined keys in the Billing console, since an unactivated tag never appears in a cost report, and only the management account can activate them. A tag policy standardises the keys and values, including their capitalisation, but it evaluates only tags that are actually applied. Requiring the key in the first place is a service control policy that denies resource creation when aws:RequestTag is absent. Enforcement matters more here than elsewhere, because a resource that goes out untagged today leaves a gap no later backfill can fill.
Give the team lead AWS Budgets rather than a monthly report. A cost budget per account, alerting at 50%, 80% and 100% of the expected monthly figure, and alerting on forecast as well as actual, is what turns an AUD$11,000 surprise into a message in the second week. Add AWS Cost Anomaly Detection over the organisation, which catches the spend nobody thought to set a threshold for. Where the risk justifies it, a budget action can apply a deny policy when a threshold is passed, which is as close to a hard cap as this gets. Worth stating plainly to the team lead: an alert notifies, and only a budget action changes anything.
Point architecture at the AWS Pricing Calculator for the pipeline. Nothing exists to measure, so Cost Explorer has no data to draw on; the Calculator takes the proposed services and sizes and produces upfront, monthly and annual figures that can be grouped by architecture, saved as a link and exported to CSV or PDF. Once the pipeline is running, Cost Explorer takes over as the tool for the same question, and the budget set from the estimate is what connects the two.
For chargeback itself, Cost Explorer grouped by account and tag covers most of what finance needs. If the model requires custom rates, shared-cost allocation or a per-team invoice with the organisation’s own rules, AWS Billing Conductor produces those views, and the Cost and Usage Report supplies the line-level detail for anything bespoke.
On support, the two halves of the platform lead’s question have two different answers. The one-hour first response on a production system down starts at Business Support+, which also brings 24/7 phone, web and chat access to Cloud Support Engineers, more than 500 Trusted Advisor checks, the Support API and the AWS Health API. Raising a case at business-critical system down on that plan puts the target under 30 minutes. A named person who already knows the architecture is a different line item: a designated Technical Account Manager comes with Enterprise Support, which also shortens the business-critical target to under 15 minutes. For a company at this size, the recommendation is Business Support+ now, with Enterprise as the step to take when the platform’s criticality justifies it. The 1 January 2027 end date on Developer Support puts a deadline on the decision either way.
One practical detail that often trips teams up: changing the Support plan does not need the root user. AWS governs it with IAM permissions, through the AWSSupportPlansFullAccess and AWSSupportPlansReadOnlyAccess managed policies, so the platform lead can be given the access to do it.
What’s worth remembering
- AWS Organizations consolidates billing into one invoice while keeping each account’s spend separately visible, and combines usage so volume pricing, Reserved Instance and Savings Plans discounts are shared across accounts.
- User-defined cost allocation tags must be activated in the Billing console before they appear in cost reports, and a management account can backfill activation up to twelve months, but only for tags the resources already carried.
- Pricing Calculator estimates what is not yet built, Cost Explorer analyses what has already been spent, and Budgets alerts on a threshold going forward.
- A budget alerts rather than caps; only a budget action changes anything, and it has to be configured deliberately.
- First response on a production system down is one hour on Business Support+, Enterprise and Unified Operations. The shorter targets belong to the severity above it, business-critical system down: under 30 minutes on Business Support+, under 15 minutes on Enterprise.
- A designated Technical Account Manager comes with Enterprise Support, and Developer, Business and Enterprise On-Ramp are all discontinued on 1 January 2027; changing the Support plan is governed by IAM permissions rather than reserved for the root user.