DevOps Tutorials, Guides & Best Practices

Closing an AWS account is not a delete button. It is the start of a 90-day post-closure period during which the account can still be reopened, still receives bills, and still counts against your organization quota. After 90 days AWS permanently closes the account, deletes the content, and the account ID can never be reused.

Three facts decide whether the process goes cleanly:

• Only the root user can close an account. You cannot do it while signed in as an IAM user or role, and the task is not supported in the AWS CLI or any SDK. It is a console-only action.
• You do not have to delete resources first, but you do keep paying for some of them. Reserved Instances, Savings Plans, and AWS Marketplace subscriptions continue to bill after closure.
• Some things cannot be recovered after the fact. A root email address or account alias used by a closed account cannot be reused by another account, and if the root email uses a domain registered in the same account through Route 53, closing the account suspends the domain and breaks email delivery to that root user.

This guide walks through the closure in the order that avoids those traps: inventory, commitments, root access, organization rules, then the actual closure and the post-closure window.

Short recommendation: if the root user’s email uses a domain registered in this same account through Route 53, transfer the domain or change the root email before you press anything. It is the only step here that can leave you with neither the account nor the email needed to recover it.

Decide what “done” means before you start

Closing the account terminates the AWS Customer Agreement for that account, but it is not the same as removing the resources you pay for. Before you start, write down which of these you actually need:

If the goal is “stop paying for one project, not close the company account”, the honest answer is to terminate the resources and keep the account. Closure is for accounts you are finished with.

Step 1: Back up data and evidence first

AWS recommends backing up anything you want to keep, and there is no automated export for you. Two categories are easy to forget:

• Data with no other copy – S3 objects, EBS snapshots, RDS snapshots, logs you still need for compliance.
• Evidence you may need later – the final invoice, the list of resources you terminated, and the inventory output from the next step. You can still view past billing during the post-closure period, but you cannot browse resources.

Step 2: Inventory resources across every Region

Charges do not stop just because you stopped looking at a Region. Note that resources in a disabled Region continue to incur charges while remaining inaccessible, so the inventory has to cover Regions you turned off too.

# every Region, including ones you may have disabled for your account
aws ec2 describe-regions --all-regions --query 'Regions[].RegionName' --output textCode language: Bash (bash)

# quick sweep: running instances per Region
for r in $(aws ec2 describe-regions --all-regions --query 'Regions[].RegionName' --output text); do
  echo "== $r"
  aws ec2 describe-instances --region "$r" \
    --query 'Reservations[].Instances[].[InstanceId,State.Name]' --output text
doneCode language: Bash (bash)

The leftovers that keep costing money after the obvious instances are gone:

# unattached EBS volumes and old snapshots
aws ec2 describe-volumes --filters Name=status,Values=available \
  --query 'Volumes[].[VolumeId,Size,AvailabilityZone]' --output table
aws ec2 describe-snapshots --owner-ids self --query 'Snapshots[].[SnapshotId,VolumeSize,StartTime]' --output table

# Elastic IP addresses: unassociated ones still bill on current pricing
aws ec2 describe-addresses --query 'Addresses[].[PublicIp,InstanceId,AssociationId]' --output tableCode language: Bash (bash)

Step 3: Terminate or transfer what still matters

Some services recreate what you delete, which is why “I terminated the instance, why is it back” is a real ticket:

• Elastic Beanstalk relaunches stopped services to keep the environment healthy. Terminate the environment before you terminate the resources it created.
• Elastic Load Balancing keeps a minimum number of instances running. Terminate the load balancer first.
• Route 53 hosted zones for domains you are keeping should be transferred to another account rather than left to the closure process.

Step 4: Check billing, subscriptions, and commitments

• Marketplace subscriptions are not cancelled automatically. Terminate every instance of the software in the subscription, then cancel the subscription on the Marketplace Manage subscriptions page.
• Reserved Instances and Savings Plans continue to bill until they expire. If they belong to a project that continues elsewhere, note the expiry dates before closing.
• The final invoice arrives the following month. Close on January 15 and the bill at the beginning of February covers usage from January 1 to January 15.
• Unpaid balances follow you. You remain responsible for all outstanding fees, and reopening an account requires full payment of the outstanding balance within 30 days of closure.

Step 5: Handle the root user, email, alias, and MFA

This is the step people skip and regret:

• Sign in as the root user; an IAM user or role cannot close the account.
• Root email address. An email registered as the root user of a closed account cannot be used as the primary email of another AWS account. If you need it elsewhere, update it before closing.
• Account alias. The same rule applies to the account alias: delete it before closure if you want to use it for a different account.
• MFA is not removed automatically. If you keep MFA enabled during the 90-day window, keep the device active in case you need to sign in. A hardware TOTP token cannot be associated with another user after permanent closure, so deactivate it first if you want to reuse the hardware.
• Route 53 domain trap. If the root user’s email uses a domain registered in this same account, do not close the account until you transfer the domain to another account or change the root email to a domain registered elsewhere. Closing the account suspends the domain, which breaks email delivery to the root address: without email you cannot recover the account, and without the account you cannot reinstate the domain.

Step 6: Treat AWS Organizations separately

Member accounts have their own rules:

• A closed member account stays in the organization until the post-closure period ends, and it keeps counting toward your account quota. Remove it from the organization first if the quota matters.
• You can close 20% or 250 of your member accounts, whichever is higher, up to a maximum of 1,000, within a rolling 30-day period. The window starts when you close the first account, not on the first of the month.
• If you use AWS Control Tower, unmanage the member account before attempting closure.
• Closed member accounts display a CLOSED label in the Organizations console for up to 90 days, then disappear.

Step 7: Close the account

1. Sign in to the AWS Management Console as the root user of the account you are closing.
2. Open the account menu in the top-right corner and choose Account.
3. On the Account page, choose Close account.
4. Type the account ID shown in the dialog to confirm you understand the process.
5. Choose Close account again to initiate closure.
6. Within a few minutes you should receive an email confirmation at the root user address. If it does not arrive within a few hours, check the account-closure troubleshooting topic before retrying.

Closure does not complete everywhere at once: it can take several hours to propagate across Regions and services. Access requests from other accounts that had permissions in your account start failing after closure.

Step 8: Watch the 90-day post-closure period

One exception is worth knowing: CloudTrail trails can continue to exist and deliver events after the account is closed unless someone explicitly deleted them beforehand. If the trails contain logs you want gone, delete them before closure.

AWS account closure checklist

Common mistakes

• Closing before transferring a Route 53 domain tied to the root email. You lose email to the root address, and with it the ability to recover the account or the domain.
• Assuming closure cancels Marketplace subscriptions. They bill until you cancel them, and the instances keep running.
• Forgetting disabled Regions. Resources there still bill and are invisible until you re-enable the Region.
• Trying to close as an IAM user. The console will not allow it, and the CLI has no command for it at all.
• Expecting the account ID back. Even after permanent closure, an AWS account ID is never reused.
• Expecting RIs and Savings Plans to stop. Both bill to the end of their term.

What to do next

Inventory before closure is easier with the CLI already installed and configured: our AWS CLI installation guide for Ubuntu covers the setup, and AWS CLI Commands for EC2, EBS, and S3 covers the resource checks you will run in step 2. If the account being closed was the one running earlier experiments, AWS IAM Roles and Trust Policies explains what to review on the receiving account, and AWS Services Explained for Developers is the map of what you are giving up. Teams consolidating accounts should read Amazon VPC Networking Components and Understanding AWS VPC Endpoints before rebuilding the network in the surviving account.

Sources

• Close an AWS account – closure procedure, root-user requirement, post-closure period, email and alias restrictions, member-account quotas
• Understanding unexpected charges – bills after closure, Reserved Instances, Savings Plans, Marketplace subscriptions, disabled Regions, Elastic Beanstalk and ELB behaviour
• AWS Organizations: remove a member account – removing an account from an organization before closure
• AWS account closure and CloudTrail trails – why trails can outlive the account

FAQ

These answers cover the closure questions that decide whether the process goes cleanly: who is allowed to close an account, what still bills afterwards, how long the 90-day window lasts, reusing an email or alias, and how many member accounts an organization can close.