Implementing Team-Level Chargeback for Kiro Subscriptions Using User Attributes for Cost Allocation

Kiro

Kiro is an AI-powered IDE that goes beyond code completion — it partners with developers across the entire software development lifecycle, from requirements and design through implementation. It combines conversational coding with a structured spec-driven workflow, letting teams move from idea to production-ready code with greater speed and confidence.

Organizations deploy Kiro through AWS using IAM Identity Center for workforce authentication, with subscription tiers ranging from Pro ($20/user/month) to Pro+ ($40/user/month) and Power ($200/user/month), each including a monthly credit allocation for AI interactions. When users exhaust their monthly credit allocation, additional usage is billed as overage at $0.04 per credit — organizations can optionally disable pay-per-use overage to cap consumption at the included tier credits.

Kiro Enterprise allows organizations to centrally manage subscriptions, control access through identity provider integration, and monitor usage through activity reports and prompt logging — all from a dedicated AWS account.

Problem Statement

Kiro subscriptions are billed through the management (payer) account under consolidated billing. While CUR 2.0 provides per-user cost visibility through individual IAM Identity Center user ARNs as resource IDs, Kiro subscriptions don't support resource-level tagging — making it impossible to attribute costs to specific teams, departments, or cost centers without additional tooling.

For large enterprises with developers spread across multiple business units - for example, a Financial Services organization with separate Risk, Compliance, Data Engineering, and Application Development teams - all using a shared Kiro instance - this creates a gap in financial accountability. The monthly bill shows a single aggregated charge, with no native breakdown by team, department, or cost center.

Challenge

Without a built-in cost attribution mechanism, organizations historically resorted to custom-built solutions:

CUR + Athena + API Look-ups: Query Cost and Usage Reports (CUR) via Athena to extract per-user charges (using the IAM Identity Center user ARN in line_item_resource_id), then call identitystore:ListGroupMembershipsForMember or identitystore:DescribeUser to resolve each user's team/ cost center, and store results in DynamoDB.

Infrastructure overhead: This approach requires CloudFormation stacks, Docker containers on AWS Batch or Lambda, Athena workgroups, DynamoDB tables, and IAM roles — all to answer a simple question: "Which team does this user belong to?" While functional, it represents significant engineering effort for what should be a billing metadata problem.

Solution: User Attributes for Cost Allocation

AWS provides a native, zero-code solution: User Attributes for Cost Allocation. When enabled, this feature automatically records organizational attributes from your Identity Provider (Microsoft Entra ID, Okta, etc.) alongside each user's subscription charges in Cost Explorer and the Cost and Usage Report.

If your organization already integrates your IdP with IAM Identity Center — where user attributes like cost center, department, and division are synchronized — this feature leverages that existing integration with no additional infrastructure.

How it works

You can select up to four attributes:

Attribute	Use Case
Cost Center	Allocate costs to specific cost centers
Division	Allocate costs to specific business divisions
Organization	Allocate costs to specific organizational units
Department	Allocate costs to specific departmental units

Key Benefits

• No custom infrastructure: No Athena queries, Batch/Fargate jobs, DynamoDB tables, or CloudFormation stacks to build or maintain.
• Automatic sync: Attributes stay current with your IdP. When a developer moves teams, cost allocation updates without manual intervention.
• Native integration: Works directly with Cost Explorer and CUR 2.0/FOCUS.
• No additional cost: The feature itself incurs no charges beyond standard CUR/Cost Explorer usage.

Step-by-Step Implementation

Prerequisites

1. AWS Organizations with consolidated billing enabled
2. IAM Identity Center managing workforce access to Kiro
3. Identity Provider integration with user attributes (cost center, division, department) populated in the directory
4. Active Kiro subscription profile in a dedicated AWS account
5. Permissions to IAM Identity Center settings and the Billing and Cost Management console (management/ payer account)

Step 1: Verify User Attributes in Your Identity Provider

Before enabling cost allocation, confirm that your IdP (Microsoft Entra ID, Okta) has the relevant organizational attributes populated as below:

• costCenter
• department
• division
• organization (or company)

Step 2: Verify Attribute Sync in IAM Identity Center

Confirm your IdP is synchronizing organizational attributes to IAM Identity Center:

1. Open the IAM Identity Center console
2. Navigate to Settings → Identity source
3. Verify that the following attributes are mapped to your IdP attributes:
   1. costCenter
   2. department
   3. division
   4. organization
4. Navigate to Users → select a Kiro user → Profile
5. Confirm the organizational attributes are populated with correct values

Note: If attributes are missing, update your IdP attribute mapping or SCIM provisioning configuration. Changes typically sync within 24 hours.

Step 3: Enable User Attributes for Cost Allocation

1. Sign in to the AWS Billing and Cost Management Console (management/payer account)
2. In the left navigation, under Preferences and Settings, select Cost Management Preferences
3. Locate the User attributes for cost allocation section
4. Select your attributes:

• ☑️ Department
• ☑️ Cost Center
• ☑️ Organization
• ☑️ Division

5. Choose Save changes

Important: These attributes are automatically activated as cost allocation tags. No additional tag activation step is required. The tag prefix userAttribute/ is used (e.g., userAttribute/costCenter), which distinguishes them from resource tags, account tags, and cost categories.

Step 4: Wait for Data Population (24–48 Hours)

After enablement:

• New billing events will include user attribute tags starting from the next billing cycle
• Allow 24–48 hours for the first tagged data to appear in Cost Explorer
• The first full billing cycle after enablement provides complete coverage

Note: Only new charges going forward will carry user attributes — historical data is not retroactively tagged. The cost allocation tag backfill feature does not apply here, as it only works for resource-level tags, not user attributes.

Step 5: Verify in Cost Explorer

1. Open AWS Cost Explorer from the management account
2. Set the date range to cover at least 2 days after enablement
3. Select Group by → Tag → userAttribute/costCenter (or userAttribute/department, userAttribute/division)
4. Apply a filter: Service = Kiro
5. Confirm that costs are distributed across your organizational attributes

You should see Kiro subscription charges broken down by cost center (or your chosen attribute), with each segment representing a team or business unit.

Step 6: Configure CUR 2.0 for Detailed Chargeback Reporting (Optional)

For granular, query-able chargeback data:

1. Ensure CUR 2.0 (or Data Exports) is enabled with resource-level data (Include resource IDs selected) a. Creating a CUR 2.0 export - https://docs.aws.amazon.com/cur/latest/userguide/dataexports-create-standard.html
2. Create a Glue Crawler pointing to the CUR 2.0 data path in S3 to build a queryable Athena table a. S3 path: s3://<your-cur-bucket>/<export-name>/CUR2/data/ b. Target Glue database: <cur_database>
3. Ensure user attribute cost allocation tags are activated a. Navigate to Billing Console → Cost Allocation Tags b. Verify costCenter, department, division, organization show as Active with Type: User attribute c. Activating user-defined cost allocation tags - https://docs.aws.amazon.com/awsaccountbilling/latest/aboutv2/activating-tags.html
4. If using Lake Formation, grant the query role SELECT and DESCRIBE permissions with all columns on the CUR table
5. User attributes appear in the tags map column alongside existing cost allocation tags. Each Kiro subscription line item includes:
   1. line_item_resource_id = IAM Identity Center user ARN (per-user identification)
   2. tags['userAttribute/costCenter'] = User's cost center
   3. tags['userAttribute/department'] = User's department
   4. tags['userAttribute/division'] = User's division
   5. tags['userAttribute/organization'] = User's organization
6. Query with Amazon Athena or your preferred BI tool to build automated chargeback reports.

Sample Athena Query:

SELECT
tags['userAttribute/costCenter'] AS cost_center,
tags['userAttribute/department'] AS department,
tags['userAttribute/division'] AS division,
tags['userAttribute/organization'] AS organization,
line_item_resource_id AS user_arn,
SUM(line_item_unblended_cost) AS total_cost
FROM
<cur_database>.<cur_table>
WHERE
line_item_product_code = 'Kiro'
AND billing_period = '<YYYY-MM>'
GROUP BY 1, 2, 3, 4, 5
ORDER BY
cost_center, total_cost DESC;

Note: User attribute tags propagate to CUR data after activation. If attributes were activated mid-billing period, usage prior to activation will appear without tag values. For complete chargeback data, ensure user attributes are populated in IAM Identity Center before the start of the billing period.

Step 7: Automate Chargeback Distribution (Optional)

For organizations that need to feed chargeback data into internal finance systems:

• AWS Cost Categories: Create a cost category rule that maps userAttribute/costCenter values to internal billing codes
• AWS Budgets: Set per-cost-center budgets for Kiro spend with alerting thresholds
• Data Exports to S3: Schedule CUR Data exports and use a lightweight Lambda or Step Functions workflow to transform and push to your finance/ERP system

---

Additional Monitoring Capabilities

While not directly related to chargeback, these Kiro Enterprise features complement your cost governance strategy:

Per-user-activity Reports

Enable CSV exports to S3 with per-user metrics: credits consumed, overage credits used, subscription tier, number of chat conversations, and model-level usage breakdown.

Configure from Kiro Console → Settings → "Collect user activity metrics and create daily reports in an S3 bucket"

• Setup guide: User Activity Tracking - https://kiro.dev/docs/enterprise/monitor-and-track/user-activity/

Prompt Logging for Compliance

Capture all user prompts and Kiro responses to an S3 bucket for security auditing, compliance, and usage analysis. Logs include user ID, timestamp, prompt content, response, and conversation metadata.

• Setup guide: Prompt Logging - https://kiro.dev/docs/enterprise/monitor-and-track/prompt-logging/

---

Key Implementation Notes

• Tag prefix: User attribute tags use the userAttribute/ prefix (e.g., userAttribute/costCenter), which distinguishes them from resource tags, account tags, and cost categories. This prevents conflicts with existing tagging strategies.

• Tax and credit handling: Tax charges appear at the account level in CUR and cannot be grouped by service or user attribute. If your chargeback model requires tax allocation, distribute it proportionally based on each cost center's share of pre-tax Kiro spend (e.g., if Data Engineering accounts for 40% of Kiro subscription cost, allocate 40% of the account-level tax to them - given only Kiro is set-up in that account)
• Organizational changes: When a developer changes teams in your IdP, the updated attribute syncs to IAM Identity Center via SCIM. Subsequent Kiro charges will reflect the new cost center. Historical charges retain the original attribution — the tag value is captured at the time of the billing event, not applied retroactively.

---

Conclusion

User Attributes for Cost Allocation eliminates the need for custom-built chargeback pipelines for Kiro subscriptions. By leveraging the organizational attributes already synchronized from your Identity Provider through IAM Identity Center, you get automatic, maintenance-free cost attribution at the team, department, or cost center level — directly in Cost Explorer and CUR.

For organizations already using IAM Identity Center with a properly configured IdP integration, the entire setup takes under 10 minutes of console configuration plus a 24–48 hour wait for data propagation. No code, no infrastructure, no ongoing maintenance.

---

References

• User Attributes for Cost Allocation - https://docs.aws.amazon.com/awsaccountbilling/latest/aboutv2/user-attributes-cost-allocation.html
• Creating CUR 2.0 Data Exports - https://docs.aws.amazon.com/cur/latest/userguide/dataexports-create-standard.html
• Kiro Enterprise Administration - https://kiro.dev/docs/enterprise/
• Kiro Pricing - https://kiro.dev/pricing/

---

Authors

Ram Achanta is a Senior Technical Account Manager at AWS, working with global banking and financial institutions to help them architect, optimize, and scale their cloud workloads while maintaining regulatory compliance. He actively drives generative AI adoption across his customer portfolio, helping enterprises implement services like Kiro, Amazon Quick, AWS DevOps Agent, and Amazon Bedrock to accelerate developer productivity and intelligent automation

Monika Agrawal is a Customer Success Specialist for Kiro at AWS, based in San Francisco, USA. She drives adoption and value realization of Kiro for enterprise customers, and strategizes to scale adoption through partners and field teams. Monika helps organizations implement AI-powered developer tools to improve efficiency and accelerate innovation.