← All articles

Advanced Cloud Cost Optimization Strategy Teams Overlook

The core answer: a governance‑first strategy that ties cost allocation tags, Service Control Policies, and Config rules together eliminates hidden waste across all AWS accounts.

Most engineering and platform teams focus on individual resources—right‑sizing EC2, deleting unused EBS, or buying Savings Plans. Those actions save money, but they do not stop new waste from being created. The overlooked tactic is to embed cost control into the account hierarchy itself. By using AWS Organizations for consolidated billing, enforcing a strict set of cost allocation tags, and locking down high‑cost services with Service Control Policies (SCPs), you create a self‑policing environment where waste is caught before it lands on the bill.

1. Set up AWS Organizations for consolidated billing

Consolidated billing gives you a single invoice for every account in the organization. It also lets you apply policies at the root level.

1.1 Create the organization (if you do not already have one)

aws organizations create-organization --feature-set ALL

The command returns the organization ID and the master account ARN.

1.2 Invite existing accounts

aws organizations invite-account-to-organization \
  --target Id=123456789012,Type=ACCOUNT \
  --notes "Add to cost‑governance org"

Accept the invitation from the member account:

aws organizations accept-handshake --handshake-id h-examplehandshakeid

1.3 Enable consolidated billing view

Log in to the master account console, go to Billing > Consolidated billing and verify that all member accounts appear under Linked accounts.

2. Define a mandatory cost allocation tag set

AWS cost allocation tags let you slice the bill by project, environment, or team. Enforcing a tag set prevents orphaned resources from slipping through.

2.1 Choose tag keys

Typical keys: - CostCenter - Project - Environment (dev, test, prod) - Owner

2.2 Activate the tags for cost allocation

In the master account console, navigate to Billing > Cost allocation tags, select the keys, and click Activate.

2.3 Enforce tags with a Service Control Policy

Create an SCP that denies creation of resources without the required tags. Example for EC2, RDS, and S3:

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Deny",
      "Action": [
        "ec2:RunInstances",
        "rds:CreateDBInstance",
        "s3:CreateBucket"
      ],
      "Resource": "*",
      "Condition": {
        "StringNotEquals": {
          "aws:TagKeys": ["CostCenter", "Project", "Environment", "Owner"]
        }
      }
    }
  ]
}

Attach this policy to the Root or to specific Organizational Units (OUs) that contain production workloads.

2.4 Verify enforcement

Attempt to launch an EC2 instance without tags:

aws ec2 run-instances --image-id ami-0abcdef1234567890 \
  --instance-type t3.micro \
  --count 1

The CLI returns an AccessDenied error with the policy statement.

3. Use Service Control Policies to cap high‑cost services

Even with tags, some services are intrinsically expensive. SCPs can restrict their use to approved accounts.

3.1 Identify costly services

Common culprits: - AWS::EC2::Instance with on‑demand pricing - AWS::RDS::DBInstance in non‑burstable classes - AWS::ElasticLoadBalancingV2::LoadBalancer

3.2 Write a cost‑cap SCP

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Deny",
      "Action": [
        "ec2:RunInstances",
        "rds:CreateDBInstance",
        "elasticloadbalancing:CreateLoadBalancer"
      ],
      "Resource": "*",
      "Condition": {
        "NumericGreaterThan": {
          "aws:RequestedRegion": "us-east-1"
        }
      }
    }
  ]
}

This example blocks creation of those services in any region other than us-east-1. Adjust the condition to match your cost‑center policy.

3.3 Apply the SCP to a sandbox OU

aws organizations attach-policy \
  --policy-id p-examplepolicyid \
  --target-id ou-xxxx-xxxxxxxx

Now developers in the sandbox OU can only launch allowed resources, preventing accidental high‑price deployments.

4. Automate detection of policy violations with AWS Config Rules

SCPs stop creation, but legacy resources can still exist. Config rules continuously evaluate resources and flag non‑compliant items.

4.1 Enable AWS Config in each member account

aws configservice put-configuration-recorder \
  --configuration-recorder name=default,roleARN=arn:aws:iam::123456789012:role/ConfigRole
aws configservice start-configuration-recorder --configuration-recorder-name default

4.2 Deploy a managed rule for required tags

aws configservice put-config-rule \
  --config-rule-name required-tags \
  --source Owner=AWS,SourceIdentifier=REQUIRED_TAGS \
  --input-parameters '{"tag1Key":"CostCenter","tag2Key":"Project","tag3Key":"Environment","tag4Key":"Owner"}'

The rule evaluates EC2, RDS, and S3 resources every 24 hours.

4.3 Create a custom Lambda to remediate missing tags

import boto3, os

def lambda_handler(event, context):
    ec2 = boto3.client('ec2')
    for record in event['detail']['configurationItem']['relationships']:
        # Example: add missing tags to an EC2 instance
        instance_id = record['resourceId']
        ec2.create_tags(Resources=[instance_id], Tags=[
            {'Key': 'CostCenter', 'Value': os.getenv('DEFAULT_COST_CENTER')},
            {'Key': 'Project', 'Value': os.getenv('DEFAULT_PROJECT')},
            {'Key': 'Environment', 'Value': 'dev'},
            {'Key': 'Owner', 'Value': 'ops'}
        ])
    return {'status': 'completed'}

Deploy the function, then attach it to the Config rule as a remediation action.

5. Visualize waste with CloudBudgetMaster’s free AWS waste finder

After the governance stack is live, you need a quick way to see the dollar impact of any remaining idle resources.

• Visit the free AWS waste finder at /tools/aws-waste-finder.
• Authenticate with an IAM role that has read‑only access to the organization.
• The tool lists untagged resources, under‑utilized instances, and orphaned EBS volumes together with an estimated monthly cost.
• Export the CSV and feed it into your ticketing system for remediation.

6. Comparison of enforcement mechanisms

7. Step‑by‑step rollout checklist

1. Create the organization and invite all accounts.
2. Activate cost allocation tags in the master billing console.
3. Write and attach SCPs that enforce tag presence and limit expensive services.
4. Enable AWS Config in every member account.
5. Deploy the REQUIRED_TAGS managed rule and optional custom Lambda remediation.
6. Run the free AWS waste finder to capture baseline waste.
7. Review the Config compliance dashboard weekly and close open findings.
8. Iterate: add new tag keys or tighten SCP conditions as the portfolio evolves.

Frequently asked questions

How do SCPs differ from IAM policies?

SCPs are applied at the organization level and act as a permission boundary for every account underneath. IAM policies are attached to users, groups, or roles inside a single account. An SCP can deny an action even if an IAM policy explicitly allows it.

Will enforcing tags break existing automation?

If your automation creates resources without tags, the SCP will reject those calls. Update your CI/CD pipelines to include the required --tag-specifications flag, for example:

aws ec2 run-instances ... --tag-specifications 'ResourceType=instance,Tags=[{Key=CostCenter,Value=123},{Key=Project,Value=Alpha}]'

Can Config rules remediate resources automatically?

Yes. By attaching a Lambda function as a remediation action, Config can add missing tags, stop unused instances, or move resources to a cheaper tier. The function runs only on non‑compliant items, keeping the cost of remediation low.

Do I need to pay for AWS Config?

AWS Config charges per recorded configuration item and per rule evaluation. The managed REQUIRED_TAGS rule is free for the first 10,000 items per month, which covers most small to medium organizations.

Key takeaways

• Consolidated billing with AWS Organizations gives you a single view and a policy enforcement point.
• Mandatory cost allocation tags, enforced by SCPs, stop waste at creation time.
• Service Control Policies can block high‑cost services in specific OUs or regions.
• AWS Config rules provide continuous audit and can trigger Lambda remediation for legacy resources.
• The free AWS waste finder shows the dollar impact of any remaining idle assets.
• A disciplined rollout checklist turns governance into a repeatable process.

By embedding cost control into the account hierarchy, you shift from reactive cleanup to proactive prevention. This strategy catches waste before it appears on the bill and scales with the growth of your cloud estate.

CloudBudgetMaster automates the same governance checks at scale. It scans AWS read‑only today, aggregates idle and wasted resources across every linked account, and reports the dollar impact. Support for GCP, Azure and Snowflake is coming soon. To start, create a free account and run the free AWS waste finder.