AWSAWS OrganizationsManagement & Governance

`aws_organizations_organization` cost estimation

The root container for multi-account AWS. AWS Organizations is free. It is the mechanism behind consolidated billing, Reserved Instance and Savings Plans sharing, and Service Control Policies that cap spend.

The aws_organizations_organization resource creates the top-level organization: a root, a set of features (billing only or ALL), and the policy types you want to enable. There is no charge for AWS Organizations. You do not pay to enable it, to add accounts, or to attach policies.

Its value is almost entirely about cost control and governance for everything else. Enabling the organization with feature_set = "ALL" unlocks Service Control Policies (SCPs), which are the strongest lever AWS gives you to prevent spend. An SCP can deny launching GPU instance families, block regions you do not operate in, or forbid creating resources without a cost-allocation tag. None of that is possible with a standalone account.

Consolidated billing is automatic once the organization exists. Every member account's usage aggregates into the management account's invoice. That aggregation pools tiered pricing (S3, data transfer out, CloudFront all get cheaper per unit at higher combined volume) and shares Reserved Instance and Savings Plans discounts across accounts by default. A Compute Savings Plan bought in one account can cover matching EC2 or Fargate usage anywhere in the organization, which is often worth 10 to 20 percent in improved commitment utilization versus buying per account.

The cost-adjacent services this resource enables are worth knowing because they are not free. AWS Config aggregated across the org, CloudTrail organization trails, and GuardDuty at the org level all bill on usage even though the organization object itself does not. An organization CloudTrail, for example, delivers events from every account and the S3 storage plus any CloudWatch Logs ingestion is real money. Enabling the organization does not turn these on, but it makes turning them on org-wide a one-click operation, so the governance stack can grow expensive quietly.

A common gotcha: switching from CONSOLIDATED_BILLING to ALL features is one-directional in practice, and enabling policy types you do not use adds no cost but does add operational surface. Enable SERVICE_CONTROL_POLICY and TAG_POLICY when you intend to author them.

c3x treats aws_organizations_organization as free and surfaces the downstream cost of the governance and workload resources it enables.

Terraform example

A minimal but realistic configuration that C3X can estimate.

resource "aws_organizations_organization" "main" {
  feature_set = "ALL"

  aws_service_access_principals = [
    "cloudtrail.amazonaws.com",
    "config.amazonaws.com",
    "sso.amazonaws.com",
  ]

  enabled_policy_types = [
    "SERVICE_CONTROL_POLICY",
    "TAG_POLICY",
  ]
}

output "org_root_id" {
  value = aws_organizations_organization.main.roots[0].id
}

Pricing dimensions

What you actually pay for when you provision aws_organizations_organization.

Dimension	Unit	What's being charged
AWS Organizations	free	The organization, its roots, feature sets, and policy attachments carry no AWS charge. $0 (free)
Organization CloudTrail (enabled through the org)	per event delivery	An org trail records management events free for the first copy, then bills for additional copies plus S3 storage and any log ingestion. $2.00 per 100,000 additional management events
AWS Config org aggregation (enabled through the org)	per configuration item	Recording configuration items across every member account is billed per item, and org-wide recording multiplies volume fast. $0.003 per configuration item recorded

Optimization tips

Common ways to reduce aws_organizations_organization cost without changing the workload.

Use Service Control Policies as spend guardrails

Prevents four-figure surprise bills

An SCP that denies GPU instance families, blocks unused regions, or requires a CostCenter tag on resource creation stops expensive mistakes before they bill. This is the single biggest cost lever the organization unlocks.

Keep RI and Savings Plans sharing enabled

10 to 20 percent better commitment utilization

Consolidated billing shares commitments across accounts by default. Leaving it on maximizes utilization of every Reserved Instance and Savings Plan you buy.

Scope org-wide governance trails deliberately

Organization CloudTrail and Config aggregation are powerful but bill per account. Record management events only, avoid duplicate trails, and set S3 lifecycle rules on the log bucket to control storage growth.

Enable only the policy types you will author

Enabling SERVICE_CONTROL_POLICY and TAG_POLICY is free but adds operational surface. Turn on what you plan to use so the governance model stays legible.

FAQ

Does AWS Organizations cost anything?

No. There is no charge for the organization, for adding member accounts, or for attaching Service Control Policies or tag policies. You pay only for the AWS usage inside member accounts and for any governance services (Config, CloudTrail, GuardDuty) you choose to run.

What is the difference between billing-only and ALL features?

CONSOLIDATED_BILLING gives you one bill and shared volume discounts but no Service Control Policies. ALL features adds SCPs and other management controls. Since SCPs are the main spend-guardrail mechanism, most organizations choose ALL.

Does enabling the organization turn on paid services?

No, but it makes them easy to enable org-wide. Organization CloudTrail, AWS Config aggregation, and GuardDuty all bill on usage. The organization object is free; the governance stack you build on it is not, so enable those services with cost in mind.

How do SCPs actually save money?

SCPs set a hard ceiling on what any account can do. Denying expensive instance families, restricting regions, and requiring cost-allocation tags all prevent spend that would otherwise be discovered only on the next invoice. They are preventive, not corrective, which is what makes them valuable.