Outcome
By the end of this lesson, you will be able to explain how AWS, Google Cloud and Azure group resources, and say how those groups and tags decide who a cost belongs to.
| Prerequisites | L1, I.1 L3 |
| Time | 8 minutes |
1. Concept
A company can rent thousands of resources. To keep them apart, every provider lets you put them into containers, a bit like folders on a computer. Each provider uses different words for these folders.
AWS: accounts
On AWS, the main folder is an account. Each account has its own resources, its own access rules and its own section of the bill. Companies usually have many accounts, for example one per team or one per environment (dev, staging, prod).
Accounts are grouped together with AWS Organizations, so that one company can manage them as a family and receive a single combined bill.
Google Cloud: projects
On Google Cloud, the main folder is a project. Every resource belongs to exactly one project. Projects can be grouped into folders, and folders sit under one organization for the whole company.
Each project is linked to a billing account, which is what actually pays. Several projects can share one billing account.
Azure: subscriptions and resource groups
On Azure, the main billing folder is a subscription. Inside each subscription, resources are placed in resource groups: smaller folders that usually hold everything for one application or one environment.
Subscriptions can be grouped into management groups, and everything sits under the company’s Microsoft Entra ID tenant (its directory of users).
The same idea three ways
| AWS | Google Cloud | Azure | |
|---|---|---|---|
| Whole company | Organization | Organization | Tenant |
| Groups of folders | Organizational units | Folders | Management groups |
| Main folder, with its own slice of the bill | Account | Project | Subscription |
| Smaller grouping inside | (tags only) | (labels only) | Resource group |
Tags: labels you stick on resources
Folders only go so far. To say more about each resource, you add tags: small labels made of a name and a value, such as team = payments or environment = dev. Google Cloud calls them labels. Tags appear on the bill, so they let you split cost by team, project or environment even inside one folder.
Tags only work if people apply them. A resource with no tags is hard to assign to anyone.
Why this matters for cost
Folders and tags are how a bill gets split by owner. If production and dev share one account with no tags, nobody can tell which team spent what. If each environment has its own account or project, and resources are tagged, the bill answers “whose is this?” on its own.
2. Worked example
A company has two teams, Payments and Search. Here is the same month of spend, organised two ways. Numbers are illustrative.
Way 1: everything in one account, no tags.
| Account | Monthly cost |
|---|---|
| main | $20,000 |
Nobody can say how much each team spent. Questions about cost go nowhere.
Way 2: one account per team and environment, plus tags.
| Account | Monthly cost |
|---|---|
| payments-prod | $7,000 |
| payments-dev | $4,000 |
| search-prod | $6,000 |
| search-dev | $3,000 |
| Total | $20,000 |
Same total. But now the Payments team can see that its dev account costs more than half of its production account and ask why. Organisation does not lower the bill by itself. It makes the bill answerable.
3. Hands-on (5 min: no account needed)
1. Open the Google Cloud documentation page "Resource hierarchy": search for "Google Cloud resource hierarchy".2. Open the Azure page "What are Azure management groups?" and find the diagram showing management groups, subscriptions and resource groups.3. Sketch your own company (or an imaginary one) on both: one organization or tenant, two teams, dev and prod for each.4. Write two tags you would put on every resource.If your sketch lets someone answer “which team owns this, and is it dev or prod?” for any resource, you have the basics of cost ownership.
4. Knowledge check
Q1
On Google Cloud, what is the main folder that every resource belongs to?
A. A resource group
B. A subscription
C. A tenant
D. A project
Show answer
Correct: D. Every Google Cloud resource belongs to one project, and each project is linked to a billing account. Resource groups and subscriptions are Azure terms, and a tenant is Azure’s company-wide directory.
Q2
What is a tag?
A. A name-and-value label attached to a resource
B. A discount code applied to a cloud bill
C. A warning shown when a resource is idle
D. The region code printed next to a charge
Show answer
Correct: A. A tag such as team = payments is a label on a resource. Tags show up on the bill, which is how cost is split by team or environment.
Q3
A company puts all its resources in one account with no tags. What problem does this cause?
A. The provider refuses to send the company a monthly bill
B. Nobody can tell which team or environment spent what
C. Every resource becomes more expensive
D. Resources can only run in one region
Show answer
Correct: B. Without separate folders or tags, the bill cannot be split by owner. Prices and regions are unaffected.
5. Apply
When you look at a bill, find the folder level first: accounts on AWS, projects on Google Cloud, subscriptions on Azure. Then look for tags. If a large share of the cost has no clear folder owner and no tags, that is the first thing to fix, before any saving can be assigned to anyone.
Related lessons
- L1, Dev, staging and prod: why there are copies
- L3, Who is allowed to create what (next)
- Foundations M0.1 L4: Tags, labels, and the cost-attribution problem
Glossary terms touched
Tag · Resource group · Multi-account