Consolidated Billing for AWS Partners

AWS Consulting Partners can grow their AWS practice by adding a service to manage billing and invoicing on behalf of their AWS customer clients.

For example, an AWS customer that already works with an AWS partner to benefit from their technical expertise is often willing to extend this to benefit from help understanding and managing their billing. As their AWS footprint grows, so does the complexity of their billing and this can become a large, regular monthly effort to keep on top of costs.

An AWS partner that uses nOps can introduce the benefits of consolidated billing to ease the burden of billing and work together to further reduce their cloud bill with intelligence management of costs and discounts.

This guide has been written for AWS partners so they can understand the simple end-to-end process of adding new clients to their nOps system.

Introduction
- Who is this guide for?
- What you’ll find in this document
  - Why this document is modular and not a monolith
  - Style
  - Terminology
Step 1 - Setting up your AWS Master Payer Account
- Suggested Reading
- How to set up a new AWS Master Payer Account
Step 2 - Set up and link nOps Accounts
- Suggested Reading
- How to setup nOps accounts
Step 3 - Configuring nOps Billing
- Understanding credit and discount sharing
- How to create a Billing Import
Step 4 - Monthly invoices
- Key points
Conclusion
- Feedback and Support
- Further reading

Introduction

There are four steps in this guide to delivering nOps-managed consolidated billing for an AWS Consulting Partner:

Step 1	Configure AWS
Step 2	Setup nOps
Step 3	Setup Billing
Step 4	Get Invoices

Who is this guide for?

This guide is for Cloud Solution Architects or FinOps Practitioners at AWS Consulting Partners that are using nOps to manage consolidated billing and invoicing for multiple clients.

There are two main scenarios for setting up consolidated billing and both are addressed in this document:

A “new” AWS partner that is doing consolidated billing for the first time. They have multiple clients with multiple accounts, but they are not using AWS Organizations yet. This is addressed specifically in Step 1, then the rest of the Steps apply.
An “existing” AWS partner that is doing consolidated billing with AWS Organizations but they want to move to nOps to benefit from the extra cost management features and invoicing.

The two scenarios are only different because of their starting point. This document delivers the same outcome in both scenarios: nOps providing monthly invoices for consolidated billing.

What you’ll find in this document

To address the three scenarios in a modular, accessible fashion we have arranged the document as follows:

Step 1	AWS Organization and Master Payer Account
Step 2	Linking nOps Accounts to AWS Accounts
Step 3	Configuring Billing Imports and Exports
Step 4	Generating Invoices for your customers

AWS Consolidated Billing is a large and complex topic and to make it more digestible in this document we have made some design designs to help:

Use a modular format instead of a monolith document.
Use font styles to clarify product features and the vendor.
Use consistent terminology to avoid confusion.

Why this document is modular and not a monolith

To keep this document to a reasonable size we have decided to modularize the content:

This document covers the entire “left-to-right” process and only goes deep enough in each step to describe the actions required.
For details on each step there are linked documents that have screenshots and deeper technical guidance.

Style

There is an intentional capitalization and coloration style in force to help clarify specific features in AWS and nOps:

nOps product components will be capitalized and coloured blue, for example as Partner Dashboard.
AWS product components will be capitalized and coloured orange such as AWS Organization.

Terminology

AWS Organizations and Consolidated Billing can be confusing and much of that confusion arises from too many new terminology / taxonomy .

The following terminology is used in this document:

Partner MPA is the Partner’s own AWS Master Payer Account all the Partner’s client AWS account bills roll-up to.
Client Member Account is the Partner’s Client’s AWS account that rolls-up it’s bills to the Partner MPA
Client MPA is a special case when a Partner’s Client has their own separate Master Payer Account.
AWS Organization is the AWS account management service that manages multiple AWS accounts under one consolidated organization.
Partner Dashboard is the Partner-level screen to access Partner-only functions of nOps.
Client Dashboard is the Client-level screen to access Client-only functions of nOps.

Step 1 - Setting up your AWS Master Payer Account

This step applies to Scenario One only, “AWS partners that are creating a new consolidated billing system, perhaps as part of a new service portfolio offering to resell AWS and/or manage customer invoicing.”

It’s recommended that your AWS Master Payer Account (“MPA”) does not run any AWS services other than those required to be responsible for AWS Organizations and billing. For this reason, and where no existing MPA is in place, it is cleaner to create a new AWS account from scratch as the MPA.

How to set up a new AWS Master Payer Account

The steps below are intended to explain the process at a high-level. For a more detailed guide please refer to nOps Documentation - Setting up Consolidated Billing.

1. Create a new AWS account

Create a new AWS account to be designated as your MPA and follow AWS account best practices for security.

Restrict who can access this MPA to only the people who will be responsible for AWS Organizations and Billing. Do not let developers or anyone other users have access.

2. Set up an S3 bucket for your AWS billing files

Follow this guide to set up an AWS S3 bucket in your Master Payer Account for your Cost and Usage Tracking Report files:

Setting up an Amazon S3 bucket for Cost and Usage Reports
Just use the defaults of no public access.
Take a note of the friendly name of your bucket, such as “acmecorp-mpa-cur” because the nOps Setup step will need this.

3. Configure Billing

Go to the Billing page of the Master Payer Account.

Paste your S3 bucket name into the Receive Billing Reports.
If you want to limit AWS credits only to the account they are applied to, select Disable credit sharing.
Configure RI discount sharing.

4. Create a new AWS Organization

Consider a structure for your Organizational Units and other AWS Organizations best practices.

An OU for the partner accounts - put your MPA in here and other internal “service accounts” you might have like a Security, Backup, Operations and DevOps.
An umbrella OU for customer accounts, then create a sub-OU under there for each customer.

Consider Service Control policies for managed client accounts, for example to not allow them to leave arbitrarily without following an exit process where they can settle their account before you remove them from your AWS Organization.

5. Add your existing AWS accounts

Use the AWS Organizations feature to Invite existing AWS accounts into your new AWS Organization.

A completed AWS Organization with an MPA might look like this:

Now you have an AWS Organization with one Master Payer Account and one or more Member Accounts organized into Organizational Units.

Step 2 - Set up and link nOps Accounts

The goal of this step is to configure nOps in preparation of the final step to link nOps Client Accounts with your AWS Master Payer Account and your AWS Member Accounts.

How to setup nOps accounts

Thanks to the nOps account setup wizard, you can create nOps accounts and link them to existing AWS accounts in one step.

1. Make sure you have an nOps Partner Account and can access the Partner Dashboard

2. Initialize your nOps environment by following the Getting Started Guide.

3. Create an nOps Client Account for your Partner AWS Accounts

Create a Client Account inside nOps that will represent your Partner MPA and other partner accounts such as a shared Operations or Security account -- all of those partner AWS accounts in AWS Organizations under the Partner Organizational Unit.

Create the Client Account “Partner-<name>-MPA”
On the Partner Client screen, find your new nOps account and click Go to account.

4. Complete the Account Setup Wizard steps

Follow the wizard on-screen instructions.

5. Create an nOps Client Account for each Client AWS Account

In your AWS Organization you should have:

Customer OU.
Under that OU there should be an individual OU for each Customer.
Under each Customer OU is where their AWS Accounts are organized.

In this step, create an nOps client for each Customer and link to one of their AWS accounts.

If the customer has multiple AWS accounts, add those later via the Add AWS Account feature in their Client Dashboard.

Now that nOps accounts have been created and linked to AWS accounts you are ready to configure AWS billing.

Step 3 - Configuring nOps Billing

By configuring nOps billing you are telling nOps about the relationship between accounts and how to process credits and discounts as part of the billing process.

This is of special importance to AWS partners that have multiple clients and may even have different billing relationships for each client.

The simple case is when a partner has one MPA and multiple clients who all have the same billing configuration with respect to credits and discounts.

❗ If a customer’s individual AWS account is set to for Reserved Instance sharing but the AWS partner Master Payer Account is set to unshared, then the customer’s setting will be over-ridden to be unshared and they can’t change it. This setting is now AWS Organization-wide and set at the Master Payer Account.

This may cause a change in the customer’s bill so the AWS partner needs to meet with the customer to set expectations about how consolidated billing might impact their bill.

The good news is that nOps Billing Exports can override the MPA Billing settings for individual client accounts. This means the customer could be reset to RI sharing which is different from the MPA setting.

Why would a partner wish to have different settings inside an AWS Org? It is likely only to be a special case. Previously the only way to do this was to have another AWS MPA with different settings, which means the partner needs to manage multiple MPAs. With nOps the partner can have a single MPA with multiple settings.

Understanding credit and discount sharing

Inside the AWS account settings for Billing, you can toggle the sharing of Credits and Discounts which means:

Sharing enabled	Any unused credit or discount will be shared across the AWS Org. Any unused credit available for sharing across the AWS org will apply.
Sharing disabled	Any unused credit or discount will be lost. Any unused credit available for sharing across the org will not apply.

Someone might disable sharing of credits and discounts to have a predictable, though more expensive, cloud bill each month.

What should I set as the AWS MPA default for sharing costs and discounts?

When their AWS account is joined to the AWS organization then it will inherit the blended cost and sharing of credits and discounts set at the Master Payer Account level.

The best configuration for nOps to assume control of costs and discounts is to configure the AWS Master Payer Account as follows:

RI / Savings Plan Sharing	Enabled	nOps will let you override this on a per-account basis from within nOps, but this default setting of enabled is most common and beneficial for overall costs, meaning isolated/unshared accounts are an exception.
Credit sharing	Disabled	Credits are intentionally applied to an individual account. If Credit Sharing is enabled then unused credits will be applied across the whole AWS Organization which is often not the intention in Partner account management. Often the client secures AWS credit and intentionally applies it to one AWS account and does not intend to share it. They never intend to share it across Partner AWS accounts.

To learn more about how AWS manages credits, read AWS Credits.

How to create a Billing Import

First you need to create a tell nOps which is your Partner MPA to import the consolidated billing from. We do this by linking it as a Billing Import.

Go to Partner Dashboard → Settings → Billing Imports

Once you click Add Billing Export, the configuration screen will appear:

How to complete each field:

Billing Import Name	Can be anything, but we recommend using your Partner Name plus “MPA” “Acme Corp MPA”
Choose Client	This is the nOps account for your Partner AWS accounts that you configured earlier and includes your MPA.
Choose an Account	This is your Partner AWS MPA.

nOps will start ingesting and processing the AWS Cost and Usage Report (“CUR”) for your Partner MPA.

How to create a Billing Export

A Billing Export is a configuration that creates a client AWS bill from your Partner MPA account (the Billing Import):

If you’ve configured a Billing Export for your Partner MPA then nOps is already processing data when it’s available from AWS.

The next step towards producing client invoices is to link the Partner MPA to the client and tell it how to process costs and discounts for that client by going to Partner Dashboard → Settings → Billing Exports.

NOTE This will override the settings in the AWS Master Payer Account, which are assumed to be set to Sharing enabled for RIs and Savings Plans.

How to complete each Billing Export field:

Billing Import Name	This is your Billing Import you created in the previous step, for example “Acme Corp MPA”
Choose Client	This is the nOps account that maps to a specific client, under which will be one or more AWS accounts.
Choose an Account	This is your Clients AWS account to report on..
Cost Type	If you don’t want the customer to benefit from a lower blended rate because perhaps the customer specifically wants an unblended rate, then select Unblended. If you select Blended then the customer’s monthly invoice will fluctuate for reasons outside of their usage and this expectation should be set.
Reserved Instances Cost Allocation	Sharing means that RI investments will be applied to the purchasing account first and then any unused will be shared across the AWS organization -- including outside the customers AWS Orgs OU. It also means they benefit from unused RIs in other organizations in the OU. Unshared means unused RIs are lost and this AWS account won’t benefit from spare RIs in the AWS Org.
Savings Plan Cost Allocation	The same concept as for RIs above.

Step 4 - Monthly invoices

As part of the AWS monthly billing cycle, nOps will automatically generate your bills for those configured Billing Exports and make them available under the Partner Dashboard Billing option

Key points

You will only get invoices for Billing Exports you have set up.
If you have AWS accounts that you have not configured a Billing Export for, then that will be shown on the Partner invoice.
If you haven’t explained how consolidated billing works, how blended costs with credit and discount sharing can influence a customer’s invoice, then you might be queried.
You clients can’t see their own invoices via their own Client Dashboard. You need to download and share the PDF with them.
If your customers still have access to the Billing Dashboard in AWS and if they don’t understand how consolidated billing works, then expect queries -- avoid these with our guide (how to prepare….)

Conclusion

This guide should have helped you to:

Step 1 - Setup AWS	Configure your AWS Organizations, consolidated billing with master payer and member accounts in Organizational Units.
Step 2 - Setup nOps	Configure nOps and add Partner and Client accounts.
Step 3 - Setup Billing	Use the Billing Imports and Billing Exports to automate client invoices from the Master Payer Account.
Step 4 - Access Invoices	Where to find invoices and how to share with clients.

Feedback and Support

We welcome feedback on this document to help us improve.

Please email help@nops.io or use live chat in the nOps application.