Account cost allocation tagging

Innovation Sandbox on AWS applies AWS Organizations account tags to sandbox accounts throughout the account lifecycle. After you activate them as cost allocation tags, these tags appear as dimensions in the AWS Billing and Cost Management console. You can then filter, group, and analyze sandbox costs by lease, user, cost report group, lease template, and account state in AWS Cost Explorer, AWS Budgets, and Cost and Usage Reports (CUR).

Tags apply to the AWS account itself, so all costs incurred in the account inherit the tag values. This complements the solution’s monthly CSV cost reports. Tagging is automatic for new leases and requires no action to enable. Leases that existed before you deployed this feature keep using the solution’s existing Cost Explorer attribution until they are terminated.

ISB account tag schema

The solution manages the following five account tag keys. All keys are prefixed with ISB-<namespace>:, where <namespace> is the namespace of your deployment. This namespacing keeps tag keys distinct across multiple deployments in the same organization, so cost queries do not aggregate across them. The keys are restricted through the Org Management Spoke Role IAM policy so that the solution can only tag accounts with these specific keys.

The ISB-<namespace>:Status tag value reflects the current account state (Available, Active, Frozen, CleanUp, or Quarantine) and is written on every OU transition. During the Active and Frozen states, the four lease tags identify the lease, while ISB-<namespace>:Status adds the lifecycle state as an additional Cost Explorer dimension.

Account tags are a best-effort cost-visibility mechanism. The authoritative source of account and lease state is the solution’s Amazon DynamoDB records. If a tagging operation fails, the failure is logged (see Alarms) and the account lifecycle operation still proceeds.

Tag lifecycle

The solution applies and removes account tags in step with the account lifecycle:

Tag activation workflow

Before account tags can be used for cost analysis, the ISB tag keys must be activated as cost allocation tags in the AWS Billing and Cost Management console. The solution automates this using an AWS Step Functions workflow deployed in the Hub account as part of the Compute stack.

On stack deployment or update, a custom resource starts the workflow. The workflow:

The custom resource returns success to AWS CloudFormation immediately without waiting for activation to complete, so deployment is not blocked by the activation process. The workflow is idempotent, so re-running it on a stack update completes immediately if the tag keys are already active.

The following table describes the workflow behavior for each stack lifecycle event.

A CloudWatch alarm monitors for any terminal non-success of the workflow that is not operator-initiated. It fires when the sum of the state machine’s ExecutionsFailed and ExecutionsTimedOut metrics over 1 hour is 1 or more. The following conditions trigger the alarm: an unhandled Lambda error; the TagActivationMaxAttemptsReached failure, which occurs when the workflow exhausts all 24 retry attempts; or the state machine’s own timeout. In this case, you can manually activate the ISB tag keys in the AWS Billing and Cost Management console. For more information, see the Manually activating cost allocation tags section.

Tag-based cost attribution

The lease monitoring Lambda function uses a tag-first approach to attribute costs for budget threshold evaluation:

This tag-first approach keeps cost monitoring accurate while tag keys propagate and for leases created before the feature was deployed, with negligible added Cost Explorer API cost.