Question

A large enterprise uses AWS Organizations with all features enabled. The finance team needs read-only access to detailed billing data, Cost Explorer, and the ability to create budgets across the entire organization. The security team has mandated that the Organizations management account be used only for account and organization management, following AWS best practices to minimize its exposure and blast radius. How should the solutions architect enable the finance team's requirements while adhering to this mandate?

Accepted Answer

Register a member account as the delegated administrator for AWS Billing/Cost Management, enable trusted access, and grant the finance team access to cost management features from that delegated account.

Answer

Create IAM users for the finance team directly in the management account and attach a policy granting access to Cost Explorer, Budgets, and the Billing console.

Answer

Enable Cost and Usage Reports in each member account and use Athena in every account so finance can query costs locally without touching the management account.

Answer

Move the finance workloads into a dedicated OU and apply an SCP that allows only billing-related API actions, then have finance operate from any account in that OU.