Designing a multi-account cloud chargeback model
cost allocation architecture.
account-per-team or mandatory cost-allocation tags enforced by SCPs and tag policies, plus a pipeline over the cost and usage report grouped by tag/account.
relying on voluntary tagging.
What's really being asked
This evaluates whether you can design governance and data plumbing that produce trustworthy per-team cost attribution at organizational scale, not just enable a billing dashboard.
The full answer
Start with structure: use AWS Organizations so each team or product maps cleanly to accounts or organizational units, which gives a hard, unambiguous attribution boundary even before tags. For finer granularity inside shared accounts, mandate cost-allocation tags such as team, environment, and cost-center. Enforce them rather than trusting goodwill: Service Control Policies can deny resource creation that lacks required tags, and tag policies standardize allowed keys and values to prevent drift like Team versus team. Activate these tags as cost-allocation tags so they appear in billing. For the pipeline, enable the Cost and Usage Report delivered to S3, load it into a warehouse like Athena, Redshift, or BigQuery, and build queries that group cost by account and tag. Allocate shared costs, such as a central logging account or support fees, with a documented split rule, and surface an untagged bucket so gaps are visible and fixable. Schedule the pipeline and publish per-team reports or dashboards.
The mistakes people make
Assuming tags will be applied voluntarily and consistently without enforcement. Forgetting to activate tags for billing, so they never reach the report. Ignoring shared and untagged costs, which makes totals not reconcile. Granting broad IAM so teams can alter each other's resources, muddying attribution and security.
What usually comes next
How do you retroactively tag existing resources. How do you handle reserved instance and savings plan discount allocation. Showback versus chargeback.
A concrete example
An SCP denies any EC2 or RDS launch missing a cost-center tag, tag policies normalize the key, and a nightly job loads the CUR into BigQuery. A scheduled query emits each team's spend plus a shared-services allocation, and an untagged line item drives weekly cleanup.
Interview question
Why is a Service Control Policy that denies untagged resource creation central to an accurate chargeback model?
- a.It guarantees tags exist so spend is attributable, not voluntaryCorrect
- b.It encrypts billing data at rest
- c.It replaces the need for a Cost and Usage Report
- d.It automatically lowers per-team cost
Why? this is the answer
Enforcing required tags at creation prevents untagged, unattributable spend that breaks chargeback accuracy. The SCP does not reduce cost or replace the CUR pipeline that actually aggregates the spend.
Just read this? Test yourself on what you have been reading.
Read the original → aws.amazon.com
- #cloud
- #finops
- #chargeback
- #governance
- #tagging
You just looked this up. Could you explain it out loud?
That is the part interviews actually test. Tezvyn takes questions like this one and gives you what the interviewer is really checking, the answer that lands, and the mistake that ends the conversation, in the four minutes before your next meeting.
The iPhone app is on the way
We are building it. Until it lands, nothing here is held back from you: every interview card, your saved cards, streaks and the job board all work in Safari, plus hundreds of free practice quizzes of thirty questions each. Sign in and it all carries over to the app the day it arrives.
Want it as an icon? Tap Share at the bottom of Safari, then Add to Home Screen. It opens full screen and the cards you have read stay available offline.
We are hiring for this. Open roles that interview on cloud — each one lists the topics its interview covers.
See open roles