AWS: Have third party pay billing while maintain operational control?

Question

AWS newbie here.

I have an application running on EC2 in my AWS account that I am building for a client. I would like the client to somehow be able to pay the monthly operational cost of the EC2 instance, while still giving me full control over operations. Is there a way to have a third party account be able to pay the billing for a specific EC2 instance? If not, what are suggested workarounds?

Clarification, copied from comment

To clarify my needs, I am a contractor and have built an application for a company. The person who originally hired me has been fired from the company and my invoice is being questioned by the finance department. I want to allow the company to use the application while we sort this matter out, but still want to have control over the app as a leverage point in case they get shady. I do not want to incur the operational costs but still allow them to run the app while the review process happens

Answer 1

Short Answer The customer owns the account, including admin rights, and grants you only the permissions you need. Create an IAM policy as per this question, attach it to a group, put your user in that group, make sure you have no other permissions. If you need SSH access you have the private key of the EC2 instance.

Long Answer

If you need access to a single EC2 instance then you just have the customer own the account and you have a private key to log into the instance.

If you need console access you need an IAM user with policies that allow specific access for different users. The customer would own the account, and as per standard they'd have both the owner account with billing access they don't use, and an admin account for day to day administration.

The admin account creates a policy that gives you EC2 access. This would grant you console access, and could give you permission to start and stop either a specific instance or any instance. It's actually very fine grained, it can be restricted by instance ID, tag, or all kinds of things.

Generally I create a policy or policies, assign them to groups, and then add a user to the group. That makes things easier if you have multiple users.

AWS has IAM policies information for EC2 here. There are some example polices here and here. None are quite right. The policy in the answer to this question is probably very close to what you need.

IAM is moderately complex to do well, and there are gotchas. You could read the documentation and watch the Re:Invent IAM sessions. You could pay someone qualified to do it for you. If you make your question specific enough about what you really need I could probably write a policy, but you're probably better off understanding it yourself. You can probably figure it out with the documentation, Re:Invent, and the IAM policy generator. There will be plenty of pre-written policies on the AWS website.

Update based on comment

In this situation consolidated billing is the best solution. It means the organisation can pay the bill without having any access to the account. If they own the account and give you access they have full access, which doesn't seem ideal for this situation.

Answer 2

You can use consolidated billing in AWS organizations

Another option is to segment billing and administrative access of a single account using IAM roles restricting one role to billing related policies and another role to operational and engineering tasks.