# An AWS foundation for a client

> Accounts, access, backups and cost from day one. Nicolas Dao's picks for this job (Cloudless Labs, Sydney), in order of preference, what he would avoid, and what to use instead.

- Use case 17 of 21 in The Stack, last reviewed 21 October 2026
- Web page: https://cloudlesslabs.com/stack/use-cases/aws-foundation/

Picks, in order of preference:

1. **[AWS Organizations + IAM Identity Center](https://cloudlesslabs.com/stack/aws-organizations-identity-center/index.md)** (My default): Accounts per environment, SSO for people.
2. **[Pulumi](https://cloudlesslabs.com/stack/pulumi/index.md)** (My default): Everything as code.
3. **[AWS Backup](https://cloudlesslabs.com/stack/aws-backup/index.md)** (My default): Backup policies as code.
4. **[Savings Plans and Reserved Instances](https://cloudlesslabs.com/stack/aws-savings-plans/index.md)** (My default): Commit once the baseline is known.
5. **[Cost Explorer (with Claude Code)](https://cloudlesslabs.com/stack/aws-cost-explorer/index.md)** (My default): Monthly review, with an agent doing the digging.

## The picks in brief

- [AWS Organizations + IAM Identity Center](https://cloudlesslabs.com/stack/aws-organizations-identity-center/index.md): My default. Centralised accounts, billing and access. Every client gets this first. Pricing: No extra charge. Control Tower is free too, but you pay for the AWS Config and CloudTrail it turns on. Replicating Identity Center to a second Region adds only the KMS key.
- [Pulumi](https://cloudlesslabs.com/stack/pulumi/index.md): My default. Infrastructure as real code. And it can use any Terraform provider, so nearly everything is provisionable from one codebase. Pricing: Free and open source with a self-managed S3 backend (no Pulumi Cloud fees).
- [AWS Backup](https://cloudlesslabs.com/stack/aws-backup/index.md): My default. Central backup policies for AWS resources. Neon branches cover the Neon side. Pricing: Sydney: S3 and EFS backups $0.06/GB-month warm (EFS cold $0.012), DynamoDB $0.114/GB-month, EBS snapshots $0.055/GB-month; Aurora and RDS snapshots bill at their own backup storage rates. Copies out of Sydney $0.098/GB for most types ($0.16 for DynamoDB and EFS). Restore tests $1.80 per recovery point. Vault Lock is free.
- [Savings Plans and Reserved Instances](https://cloudlesslabs.com/stack/aws-savings-plans/index.md): My default. My main lever on AWS cost. AWS margins are high; commitments bring them down. Pricing: Sydney, on-demand to committed: Aurora PostgreSQL db.r7g.large $0.333/h to $0.256/h (1-year Reserved Instance, no upfront) or about $0.176/h (3-year, all upfront). Fargate $0.0486 per vCPU-hour to $0.0413 (1-year Compute Savings Plan, no upfront) or $0.0257 (3-year, all upfront). Lambda duration only 12 to 17% off; requests not at all.
- [Cost Explorer (with Claude Code)](https://cloudlesslabs.com/stack/aws-cost-explorer/index.md): My default. Where every cost investigation starts. I let Claude Code read it and find the culprit. Pricing: The console is free. The API costs $0.01 per paginated request. Hourly data for the last 14 days is opt-in, at $0.01 per 1,000 usage records a month.

## Related

- [Infrastructure as code](https://cloudlesslabs.com/stack/layers/iac/index.md): every tool in this layer
- [Accounts, identity and cost](https://cloudlesslabs.com/stack/layers/accounts/index.md): every tool in this layer
- [Every use case and tool in one file](https://cloudlesslabs.com/stack/brief.md)
- [Map of every Markdown file on cloudlesslabs.com, with what each one answers](https://ask.cloudlesslabs.com)