title: AWS Consolidated Billing and multiple accounts in AWS
body: <p>I will be hosting infrastructure for several different clients. Complete, total, 100% separation of client's AWS infrastructure is necessary (leagal etc). So I need some advice on how best to structure my accounts.</p>
  
  <p>I will have a master account with MFA. It will not actually ever spin-up and infrastructure. It is merely to be a top-level billing account. Then each client will have their own separate AWS account. With I guess a separate root login and separate MFA. Each client account will be linked to the Master account for consolidated billing. This is neat because if they move their business else where then we just give them the IAM details for the account and strike it off from Master and we are done. </p>
  
  <p>What I am not sure of is that to set up a brand new AWS account you need a unique email account. We don't want the client to ever have to first setup the account so do we need to have a whole bunch of email aliases to use on our company domain (client@mydomain.com, client2@mydomain.com etc) and then use them to set up new AWS accounts? Is there a better way than this? It could get pretty clunky to have to have a new email alias every time a new client joins.</p>
  
  <p>Second, will we need a box full of MFA devices - one for each account, or will the same device work for all accounts?</p>
  
  <p>Any pointers gratefully received. Thanks</p>