Why this matters
The tags you put on the IAM users and roles that call your models now come through as dimensions you can group and filter on. Tag a role with costCenter, department, email, or name, group by that key, and the model spend those callers drove shows up underneath.
That gives you the human-readable half of caller identity. A caller ARN like assumed-role/inference-gateway/session-8842 names a role. The tags on that role carry what someone wrote on purpose: the cost center that owns it, the team that runs it, the person to email about it. When those travel with the spend, chargeback becomes a group-by. Finance asks who owns this month’s Bedrock line, you group by iamPrincipal/costCenter, and the split across teams is on screen.
It works in both directions. A team that thinks its inference spend is small can see the actual number attached to its own cost center. A team carrying more than it expected finds out while there is still a month left to change how it calls the model. Both conversations start from a name a person recognizes rather than an ARN someone has to go decode.
The tagging you already do on your principals is what powers it. There is no separate allocation scheme to maintain and no mapping table to keep current.
What we built
CloudZero recognizes iamPrincipal tags during CUR 2.0 ingestion and carries each tag’s values through the tag pipeline, so one can build dimension against these tags and its values.
They also pair with the Bedrock caller identity dimension we shipped in June. That one attributes the caller ARN on Bedrock rows. This one adds the tags you put on those principals, so you can start from a cost center or a team name and drill to the specific role underneath.
How it works
The data comes from your AWS bill, so there is nothing to instrument and no agent to deploy. Three things have to be true on the AWS side, all one-time setup.
Tag the IAM principal ARN that call your models with the keys you want to allocate on. Activate those tags in the Billing console under Cost Organization > Cost Allocation Tags, filtering for IAM principal type tags. Then, in your CUR 2.0 data export, select Include caller identity (IAM principal) allocation data under Additional export content and ensure the Tags Column is enabled.
Two AWS timing details worth planning around. A tag key becomes available for activation after the tagged principal has made at least one API call, and AWS takes up to 24 hours to surface the key and up to another 24 to activate it. Budget two days between tagging a role and expecting it in a report.
One sizing note. Caller identity data multiplies your CUR row count by the number of distinct identities calling each model, so exports and the S3 costs behind them grow with it.
On the CloudZero side, a CUR 2.0 connection is the prerequisite. Once tags are flowing, group or filter on them in Explorer, or reference them in a Dimension the same way you would any other tag key.
