Tags on Resources

"Cost Center" Tag

Used to help facilitate automated billing via the Cornell KFS system.
Any AWS resource with that tag will be billed directly to the provided account number.
Anything in a Cornell AWS account that is not tagged (or cannot be tagged) will be billed to the Cornell account number associated with the AWS account as a whole.
Note that applying the "Cost Center" tag to a resource does not retroactively adjust the billing data for the resource, prior to the tag being set. E.g., If you have an EC2 instance running 24/7 and you set the "Cost Center" tag for that instance on the 15^th day of the billing period, the "Cost Center" will be billed the cost of the EC2 instance starting from that day forward.

Tag key/name: "Cost Center"

Tag value formats:

A seven-character KFS account number.
OR
A seven-character KFS account number, followed by a hyphen, followed by a sub-account number.
OR
A fully qualified KFS accounting string as outlined here: https://finance.cornell.edu/accounting/chartofaccounts/transactionstring
- Under this scheme, the parts of the accounting string labeled as optional in the link above can be left off, but a total of six hyphens are required.

Be careful to use the correct capitalization and spacing for the "Cost Center" tag name. There is one space between "Cost" and "Center".
Be sure to use a correctly formatted KFS account number as described above. In particular "123-4567" is NOT a correctly formatted KFS account number, but "1234567" IS correctly formatted.

"Cost Center" tags with incorrect spacing or capitalization, or with invalid KFS account formats will be ignored by the automated billing system.

Optional Tags

Tags with these names are propagated to billing data. Tags with any other names are NOT propagated to billing data.

"Application"
- Identifies the software application this Amazon resource supports.
- Resources used by multiple applications could have a suggested value of “infrastructure”
- the application should be in all lowercase
- This tag is required on all billable resources for CIT AWS accounts
  - For resources used by staff for learning, experimentation, and trials, we suggest using the value of "sandbox".
  - In the joint training account, we suggest using the value "training".
"Deployment"
- This can be any identifier that makes sense for your deployment.
"Environment"
- This can be any identifier that makes sense for your deployment.
"Functional Contact"
- This should be a netid or an email address.
"Project"
- This can be any identifier that makes sense for your deployment.
"Resource"
- This can be any identifier that makes sense for your deployment.
"Technical Contact"
- This should be a netid or an email address.

AWS resource types that incur charges but cannot be tagged

Note that not all AWS resource types can be tagged. If a specific AWS resource type cannot be tagged but still incurs charges, there is no way to target those charges to a KFS account other than the default KFS account configured for the AWS account.

See AWS documentation "Tagging AWS resources".

How to determine what's tagged and what's not

Use the resource group tag editor in your AWS Console: https://resources.console.aws.amazon.com/resource-groups/tag-editor/find-resources

Tags on IAM Principals or IAM Sessions

Caveats

As of 05 Jun 2026:

The IAM principal cost allocation tags listed below are enabled, but are not passed to the Cornell AWS billing system. However, they may provide functionality to Cornell AWS customers who need to re-bill AWS charges internally.
Customer-managed roles integrated with Cornell Shibboleth (e.g., shib-my-role) can be tagged. But Shibboleth roles managed centrally (e.g., shib-admin, shib-cs, shib-itsg) cannot be tagged directly.
IAM roles created by AWS Identity Center (aka AWS SSO), like sso-admin, cannot be tagged.
To get tags applied to spend by IAM principals that cannot be tagged (e.g., shib-admin), you must use session tagging. See Passing session tags in AWS STS.
- However, you cannot use session tags with AWS Identity Center roles (e.g., sso-admin) because AWS manages sessions for those roles internally.
AWS Bedrock is the only service that supports IAM principal cost allocation tags. I.e., only charges for Bedrock are labeled with the tags of the IAM principal or session that triggered the spend.

"Cost Center" Tag

Similar to "Cost Center" tags on resources, "Cost Center" tags on IAM principals (or sessions) can be used to add KFS account information to AWS billing data. The "Cost Center" tag on IAM principals can be used in AWS Cost Explorer to filter or breakdown spend. "Cost Center" tags on IAM principals can also be seen in CUR 2.0 cost data exports. See Cost and Usage Report (CUR) 2.0.

Other Tags

As of 05 Jun 2026, no other IAM principal/session tags are enabled for cost allocation.