AWSAWS OrganizationsManagement & Governance

`aws_organizations_account` cost estimation

A member account inside an AWS Organization. Creating and managing accounts is free. The cost lives inside each account: all EC2, S3, RDS, and data transfer usage rolls up to the organization's consolidated bill.

The aws_organizations_account resource creates a new AWS account (or invites an existing one) as a member of your organization. AWS charges nothing for the account itself. You can run one account or ten thousand, and the account count never appears as a line item.

What makes this resource cost-relevant is consolidated billing. Every member account's usage aggregates into a single payer account bill. That aggregation is not just cosmetic. It is where volume discounts, Reserved Instance sharing, and Savings Plans sharing happen. If one account buys a Compute Savings Plan and another account runs matching EC2, the discount applies across the organization automatically (unless you turn RI/SP sharing off). Tiered pricing also pools: S3 storage tiers, data transfer tiers, and CloudFront tiers are calculated on combined organization usage, so many small accounts can reach a cheaper tier together than they would alone.

The real spend driver is what runs inside each account, not the account object. A brand new account created by this resource costs $0. The moment someone launches a db.r6g.large RDS instance in it (around $0.48/hour, roughly $350/month), that cost appears on the consolidated bill. Sprawl is the classic problem: teams spin up sandbox and per-developer accounts, forget them, and leave idle NAT Gateways ($0.045/hour plus data processing), unattached EBS volumes ($0.08/GB-month for gp3), and orphaned load balancers ($0.0225/hour for an ALB) running for months.

A subtle gotcha: deleting a member account is not instant and not fully self-service via Terraform. Closed accounts enter a 90 day suspension window during which they can be reopened, and any usage before closure still bills. Also, the management (payer) account should stay clean of workloads so that Service Control Policies and billing stay easy to reason about.

c3x flags aws_organizations_account as free and attributes the real cost to the resources deployed inside each account.

Terraform example

A minimal but realistic configuration that C3X can estimate.

resource "aws_organizations_organization" "main" {
  feature_set = "ALL"

  enabled_policy_types = [
    "SERVICE_CONTROL_POLICY",
    "TAG_POLICY",
  ]
}

resource "aws_organizations_organizational_unit" "workloads" {
  name      = "Workloads"
  parent_id = aws_organizations_organization.main.roots[0].id
}

resource "aws_organizations_account" "team_prod" {
  name      = "team-prod"
  email     = "aws+team-prod@example.com"
  parent_id = aws_organizations_organizational_unit.workloads.id

  role_name = "OrganizationAccountAccessRole"

  # Prevent accidental deletion of the account
  lifecycle {
    ignore_changes = [role_name]
  }
}

Pricing dimensions

What you actually pay for when you provision aws_organizations_account.

Dimension	Unit	What's being charged
Organization member account	free	Creating, inviting, and managing member accounts carries no AWS charge regardless of account count. $0 (free)
Usage inside the account (example: RDS)	per hour	All compute, storage, and data transfer inside a member account bills to the consolidated organization invoice. $0.48/hour for db.r6g.large RDS in us-east-1
Idle waste inside forgotten accounts (example: NAT Gateway)	per hour	Account sprawl leaves idle infrastructure running. A single NAT Gateway left in an unused sandbox account keeps billing. $0.045/hour plus $0.045/GB processed

Optimization tips

Common ways to reduce aws_organizations_account cost without changing the workload.

Keep Reserved Instance and Savings Plans sharing enabled

10 to 20 percent higher commitment utilization

Consolidated billing shares RI and Savings Plans discounts across all member accounts by default. Leaving sharing on lets one account's commitment cover unused capacity in another, raising overall utilization.

Vend accounts from a factory with guardrails, not by hand

Use Control Tower or a landing zone pipeline so every new account ships with budgets, tag policies, and a cost anomaly monitor. This prevents the silent sprawl that inflates the consolidated bill.

Sweep idle resources in sandbox and per-developer accounts

$30 to $100/month per forgotten NAT Gateway

Sandbox accounts accumulate idle NAT Gateways, unattached EBS volumes, and orphaned load balancers. A scheduled cleanup (or an SCP that blocks expensive resource types) stops the leak.

Group accounts by workload and environment for clean cost allocation

Placing prod, staging, and dev in separate accounts under labeled OUs makes cost-per-environment obvious in Cost Explorer without heroic tagging discipline.

FAQ

Does AWS charge per account in an Organization?

No. There is no per-account fee and no limit-driven surcharge. You are billed only for the AWS usage inside each account, all of which rolls up to the management account's consolidated invoice.

How does consolidated billing save money?

Two ways. First, tiered pricing (S3, data transfer, CloudFront) is calculated on combined organization usage, so pooled volume reaches cheaper tiers faster. Second, Reserved Instances and Savings Plans are shared across accounts by default, so a commitment in one account can discount matching usage anywhere in the organization.

What happens to costs when I close a member account?

Usage bills right up to closure. After closing, the account sits in a 90 day suspension window where it can be reopened but should incur no new charges if its resources were deleted first. Always tear down resources before closing, since a closed account with a live NAT Gateway or RDS instance can still generate charges until everything is actually removed.

Should I run workloads in the management (payer) account?

No. Keep the management account empty of workloads. It is the billing and policy control point, and mixing production resources into it complicates Service Control Policy design and makes the blast radius of a compromise much larger.