We want to allow our customers to create AWS resources (let’s say EC2, S3, and VPCs) and then at the end of the month bill each of them for whatever they used.

Typical restrictions apply:

• We don’t want one customer to be able to clobber another’s resources
• We want to generate a report/bill programmatically via APIs
• We want to be able to revoke access at any time, programmatically

The AWS documentation makes it seem the way this should be done is that we provision our AWS account, that account creates an organization, then every customer would be an account that belongs to the organization.

The documentation seems clear that we can get price breakdowns of each account within the org, but we’re not 100% sure.

The part where we totally lose confidence is trying to figure out how to programmatically generate billing data at the end of the month. Documentation is very unclear on if this is possible (though it seems obvious it should be?)

Also, we find references in some places of people saying actually there should be one organization per customer, rather than one account per customer, and we wonder the pros and cons of architecting our solution like that, rather than one account per customer all in a single org.