AWS Governance and Cost

Governance and cost are the same problem seen from two directions. The account structure that keeps a production workload away from an experiment is also the structure that tells you which team spent the money, and the policy that stops someone opening a bucket to the internet is the same mechanism that stops them launching an instance you cannot afford.

This section covers the AWS services that do that work, grouped by the question they answer.

Organizations — how accounts are grouped and what they are allowed to do. Start with Organizations, accounts, OUs and policies, which explains the management account, organizational units, and the two policy families (authorization and declarative). From there, cross-account role access covers how a person or a third party gets into an account without long-lived credentials, and AWS Resource Access Manager covers sharing a subnet, a Transit Gateway or a private CA instead of duplicating it.

Compliance — how you detect and prevent drift. AWS Control Tower is the opinionated landing zone that sets the rest up for you; AWS Config is the configuration record and rule engine underneath it; AWS Trusted Advisor and AWS Compute Optimizer give you recommendations you did not have to write; and AWS Health tells you when AWS itself is the cause. AWS License Manager covers the vendor-licence side of the same problem: proving what you are entitled to run.

Cost management — how you see the bill and shape it. The cost management tools page covers Cost Explorer, Budgets and consolidated billing; Cost and Usage Reports covers the raw data underneath them. The commitment mechanisms are split between Savings Plans and instance purchasing options (Reserved Instances, Spot, Dedicated Hosts). Underneath all of it, tagging and resource groups is what makes spend attributable, cross-account cost management covers budgeting across an organization, cost optimization strategies covers the levers that actually reduce a bill, and cloud cost fundamentals covers the finance vocabulary a business case needs.

Service Catalog — how you let teams provision infrastructure themselves without handing them administrator rights. See AWS Service Catalog.

Well-Architected — the review framework that turns architecture opinions into a prioritised backlog. See the AWS Well-Architected Tool.

Services named here that AWS has since closed

Two services that appear throughout older governance material can no longer be adopted, and each has a page saying so rather than being quietly removed:

• AWS OpsWorks — all three offerings reached end of life during 2024. AWS Systems Manager replaces the operational half.
• AWS Proton — takes no new customers and support ends on 7 October 2026. AWS Service Catalog plus a shared CloudFormation or CDK library replaces it.

AWS App Mesh is also being discontinued on 30 September 2026; it is mentioned here only because older material lists it as something worth sharing through AWS RAM.