AWSAWS OrganizationsManagement & Governance

`aws_organizations_policy` cost estimation

Service Control Policies, tag policies, and backup policies attached to an organization. The policies are free. Their job is to prevent spend: SCPs can block expensive instance families, regions, and untagged resources.

The aws_organizations_policy resource defines a policy document (a Service Control Policy, tag policy, backup policy, or AI opt-out policy) and attaches it to the root, an organizational unit, or an account. AWS charges nothing for policies. You can author and attach as many as you like at no cost.

The reason this free resource matters for cost is that Service Control Policies are the strongest preventive spend control AWS offers. An SCP is a permission boundary: it cannot grant access, only remove it. That makes it ideal for hard financial guardrails. A single SCP can deny launching p5 or trn2 GPU instances (which run into thousands of dollars a month each), block regions outside your operating footprint so no one accidentally spins up capacity in ap-south-1, or deny any ec2:RunInstances call that lacks a CostCenter tag so cost allocation stays clean. These controls stop spend before it starts, which is far cheaper than discovering it on the invoice.

Tag policies are the cost-allocation companion. They standardize tag keys and allowed values across accounts, so Cost Explorer and cost-allocation reports actually group correctly instead of scattering spend across CostCenter, cost_center, and costcentre. Poor tagging is one of the most common reasons organizations cannot answer who spent what, and a tag policy is the free enforcement mechanism.

Backup policies enforce AWS Backup plans org-wide. Here the policy is free but the backups it mandates are not: AWS Backup warm storage runs about $0.05/GB-month and cross-region copies add data transfer, so a backup policy that snapshots every volume daily and retains for a year has a real, and sometimes surprising, cost that lands in every member account.

A gotcha worth knowing: SCPs do not apply to the management account, and an overly broad Deny can lock out legitimate automation. Test with a narrow OU before attaching at the root, and remember that the FullAWSAccess policy is attached by default; removing it without a replacement Allow denies everything.

c3x treats aws_organizations_policy as free and highlights the downstream cost impact of the backups and services the policies govern.

Terraform example

A minimal but realistic configuration that C3X can estimate.

resource "aws_organizations_policy" "deny_expensive" {
  name        = "deny-gpu-and-foreign-regions"
  description = "Block GPU instances and regions we do not operate in"
  type        = "SERVICE_CONTROL_POLICY"

  content = jsonencode({
    Version = "2012-10-17"
    Statement = [
      {
        Sid      = "DenyGpuFamilies"
        Effect   = "Deny"
        Action   = "ec2:RunInstances"
        Resource = "arn:aws:ec2:*:*:instance/*"
        Condition = {
          "ForAnyValue:StringLike" = {
            "ec2:InstanceType" = ["p5.*", "p4d.*", "trn2.*"]
          }
        }
      },
      {
        Sid       = "DenyForeignRegions"
        Effect    = "Deny"
        NotAction = ["iam:*", "organizations:*", "cloudfront:*", "route53:*"]
        Resource  = "*"
        Condition = {
          StringNotEquals = {
            "aws:RequestedRegion" = ["us-east-1", "us-west-2"]
          }
        }
      },
    ]
  })
}

resource "aws_organizations_policy_attachment" "attach" {
  policy_id = aws_organizations_policy.deny_expensive.id
  target_id = aws_organizations_organizational_unit.workloads.id
}

Pricing dimensions

What you actually pay for when you provision aws_organizations_policy.

Dimension	Unit	What's being charged
Organizations policy	free	Authoring and attaching SCPs, tag policies, backup policies, and AI opt-out policies carries no AWS charge. $0 (free)
Backups mandated by a backup policy	per GB-month	A backup policy is free, but the AWS Backup warm storage it enforces across accounts is billed per GB stored. $0.05/GB-month warm storage
Spend prevented by a Service Control Policy	avoided	An SCP that denies GPU families prevents accidental launches of instances that would otherwise bill thousands per month. Avoids $2,000+/month per blocked GPU instance

Optimization tips

Common ways to reduce aws_organizations_policy cost without changing the workload.

Deny expensive instance families you never intend to use

$2,000 to $40,000/month per avoided GPU instance

Most teams never need p5 or trn2 GPU instances. An SCP that denies those families removes an entire category of four-figure accidental spend across every account at once.

Restrict to the regions you actually operate in

A region-restriction SCP stops resources from appearing in regions where you have no monitoring, no cleanup automation, and no reason to be. Idle infrastructure in a forgotten region is a classic silent cost.

Enforce cost-allocation tags at creation with an SCP

Deny ec2:RunInstances and other create calls that lack a CostCenter or Team tag. Combined with a tag policy for allowed values, this keeps Cost Explorer reports accurate without manual cleanup.

Right-size backup policies before rolling them out

Cold storage is roughly 5x cheaper than warm for long retention

Backup policies are free but the enforced backups are not. Match retention to actual recovery needs and use cold storage tiers for long retention so a daily-snapshot mandate does not balloon storage cost across every account.

FAQ

Do Organizations policies cost anything?

No. Service Control Policies, tag policies, backup policies, and AI opt-out policies are all free to author and attach. Their cost impact is indirect: they either prevent spend (SCPs) or drive spend in downstream services (backup policies enforcing AWS Backup).

How is an SCP a cost control if it only removes permissions?

Preventing an action prevents its bill. Denying GPU instance families, expensive regions, or untagged resources stops the spend before any resource is created. Preventive guardrails are cheaper and safer than detecting and deleting costly resources after the fact.

Can an SCP accidentally cause problems?

Yes. SCPs are deny-by-effect and apply to every principal in the target except the management account. An overly broad Deny can block legitimate automation or CI/CD roles. Test on a narrow OU first, and never remove the default FullAWSAccess policy without an explicit replacement Allow.

Why pair a tag policy with an SCP?

The SCP enforces that a tag key is present at creation; the tag policy enforces that its value is from an approved list. Together they keep cost-allocation data clean, which is what makes Cost Explorer and chargeback reports trustworthy.