Cost-Optimized Architecture Design · Topic 7 of 8
Cost Allocation Tagging and Chargeback
Design cost allocation tags, enforce them with tag policies, SCPs and AWS Config, and build chargeback with cost categories and split cost allocation data.
- 6 min
- Only the management account activates cost allocation tags for an organization.
- Tag keys can take up to 24 hours to appear and up to 24 hours more to activate.
- Backfill of activated tags reaches up to 12 months, only for tags that existed then.
What it is
Cost allocation answers one question: who spent this money? In a multi account organization the answer comes from accounts, tags and rules that group them into business units, projects and environments.
Showback reports each team's cost so they can see it. Chargeback goes further and bills the cost back to the team's budget. Both depend on consistent tags and on a way to divide shared costs fairly.
How it works
Designing the tagging strategy
Start with accounts. A multi account structure grouped by business unit and environment gives clean allocation for free, because every charge carries its account. Tags then add the detail that accounts cannot show, such as project, application or cost center inside a shared account.
| Tag key | Purpose | Example values |
|---|---|---|
| CostCenter | Finance owner for chargeback | 1001, 2040 |
| Project or Application | What the spend supports | payments, search |
| Environment | Separate production from non production | prod, test, dev |
| Owner | Who to contact about waste | team email alias |
Keep the list short, agree on exact key names and allowed values, and document them. Tags are case sensitive, so CostCenter and costcenter become two separate keys in billing data.
Activating cost allocation tags
Tags appear in billing data only after they are activated as cost allocation tags. In an organization, only the management account can activate them, and activation applies to the whole organization.
New tag keys can take up to 24 hours to appear for activation, and up to 24 more hours to activate. AWS generated tags, such as aws:createdBy, can also be activated. The management account can backfill activated tags for up to 12 months of past cost data, but only for tags that were actually on the resources at that time.
Enforcing tags with policy
No single control does everything, so the exam often expects a combination.
| Control | What it does | Limit |
|---|---|---|
| Tag policies in AWS Organizations | Standardize key names, case and allowed values, and report noncompliance | Enforcement blocks noncompliant tag values but does not force a tag to exist |
| SCPs | Deny create actions when a required tag is missing, using aws:RequestTag conditions | Never grant permissions, do not affect the management account, and depend on service support for tag on create |
| AWS Config rules | Detect untagged resources, for example the required-tags managed rule, and trigger remediation | Detective, acts after creation |
| Infrastructure as code defaults | Apply standard tags in templates | Only covers resources created through the pipeline |
A typical design uses a tag policy for consistent values, an SCP that denies launching resources without a CostCenter tag, and an AWS Config rule with an organization conformance pack to catch anything that slips through.
Cost categories and shared costs
AWS Cost Categories map costs into your own business structure using rules on accounts, tags, services, charge types and other categories. A category such as BusinessUnit can then be used in Cost Explorer, AWS Budgets and the Cost and Usage Report.
Shared costs, such as a central networking account or enterprise support, need a fair split. Split charge rules in cost categories allocate one category's cost to others proportionally, evenly or by fixed percentages.
Split cost allocation data for containers
Many teams share one Amazon ECS or Amazon EKS cluster, so the EC2 instance cost does not show which service used it. Split cost allocation data allocates the cluster cost to individual tasks or pods based on the CPU and memory each one reserves or uses, and adds that detail to the Cost and Usage Report.
Generative AI chargeback with Amazon Bedrock
Bedrock spend is driven by tokens, so allocation needs per caller or per application data.
- Create an application inference profile for each team or application and tag it. Its usage and cost are tracked separately and appear under its cost allocation tags.
- Tag IAM users and roles and turn on IAM principal data in a CUR 2.0 export to see Bedrock cost per caller. A shared gateway role hides individual callers, so allocate at the application profile level in that case.
- Track token usage in CloudWatch with the
InputTokenCountandOutputTokenCountmetrics, by model, for near real time showback and alarms.
Pro forma billing
When chargeback must use internal rates rather than the AWS bill, AWS Billing Conductor builds pro forma bills for groups of accounts. It does not change what AWS charges the payer.
How the exam asks about this
- "New resources keep launching without a CostCenter tag in member accounts." -> An SCP that denies create actions when
aws:RequestTag/CostCenteris null, plus AWS Config for detection. - "Ten teams share one EKS cluster, and finance wants per team cost." -> Split cost allocation data for Amazon EKS in the Cost and Usage Report.
- "Several applications call Bedrock and each must see its own model cost." -> Tagged application inference profiles per application.
What to remember for the exam
- Only the management account activates cost allocation tags for an organization.
- Tag keys can take up to 24 hours to appear and up to 24 hours more to activate.
- Backfill of activated tags reaches up to 12 months, only for tags that existed then.
- Tag policies standardize values but do not force a tag to be present.
- SCPs deny untagged creation but never grant access and do not affect the management account.
- Cost categories with split charges divide shared costs, and split cost allocation data divides container clusters.
Do not rely on tags alone for allocation when accounts can separate the spend. Account boundaries are always accurate, while tags depend on every resource being tagged correctly.
Common mistakes
Expecting tags to show in billing straight away. User defined tags must be activated in the management account first, and activation takes time.
Using a tag policy to require tags. Tag policies control the format and values of tags. To block untagged creation, use an SCP condition or a deployment guardrail.
Ignoring shared costs. Showback that leaves networking, security and support costs unassigned understates each team's true cost. Use split charge rules.
Check yourself
Which account activates cost allocation tags for an AWS organization?
The management account, and the activation then applies across the organization's billing data.
How can a team block creation of EC2 instances that lack a CostCenter tag?
Attach an SCP that denies the create action when the
aws:RequestTag/CostCenterkey is missing.How can finance see the cost of each team sharing one ECS cluster?
Turn on split cost allocation data for Amazon ECS, which allocates instance cost to tasks by their CPU and memory.
Topic 7 of 8 in Cost-Optimized Architecture Design
Test yourself on Cost-Optimized Architecture Design
The full AWS SAP-C03 question bank has 850 questions, with timed practice exams and an explanation for every answer.
This study guide is independent and is not affiliated with, endorsed by, or sponsored by AWS. Vendor names, certification names and exam codes are trademarks of their respective owners and are used for identification only.