AWS cur documentation change

Service: cur · 2026-03-04 · Documentation low

File: cur/latest/userguide/table-dictionary-cur2-tag-columns.md

Summary

Added documentation explaining AWS tag prefixes and how overlapping tag keys are handled across different tagging mechanisms to prevent conflicts.

Security assessment

While the change improves understanding of secure tagging practices by explaining namespace prefixes (resourceTags/, userAttribute/, etc.), there's no evidence it addresses an active security vulnerability. The documentation primarily focuses on cost allocation accuracy rather than security remediation.

Diff

diff --git a/cur/latest/userguide/table-dictionary-cur2-tag-columns.md b/cur/latest/userguide/table-dictionary-cur2-tag-columns.md
index 40f281ebe..a20dc5721 100644
--- a//cur/latest/userguide/table-dictionary-cur2-tag-columns.md
+++ b//cur/latest/userguide/table-dictionary-cur2-tag-columns.md
@@ -5 +5,3 @@
-# Tag Column
+Understanding Tag Prefixes and Overlapping Tag Keys
+
+# Tags Column
@@ -12,0 +15,60 @@ tags |  A map column containing key-value pairs of all tags and their values for
+## Understanding Tag Prefixes and Overlapping Tag Keys
+
+When using cost allocation tags alongside other AWS tagging mechanisms, you may encounter situations where the same tag key (such as "department" or "aws:createdBy") appears across different tagging contexts. AWS automatically prefixes these tags to prevent conflicts and ensure accurate cost allocation. 
+
+**Tag Prefix Types**
+
+AWS uses the following prefixes to distinguish between different tag sources: 
+
+  1. resourceTags/ - Tags applied directly to AWS resources.
+
+  2. userAttribute/ - User attributes imported from IAM Identity Center.
+
+  3. accountTag/ - Tags applied at the AWS account level.
+
+  4. costCategory/ - Tags derived from AWS Cost Categories.
+
+
+
+
+**Example: Overlapping Tag Keys**
+
+Consider a scenario where multiple tagging mechanisms use the same tag keys. Here's how AWS handles them:
+    
+    
+    {
+      "resourceTags/department": "teamA", 
+      "resourceTags/appName": "app1", 
+      "userAttribute/Department": "teamB", 
+      "accountTag/department": "teamC", 
+      "accountTag/appName": "app3", 
+      "costCategory/department": "teamD"
+    }
+    			
+
+In this example:
+
+  * The resource is tagged with department "teamA" at the resource level
+
+  * The user who accessed the resource belongs to the "teamB" department in IAM Identity Center
+
+  * The AWS account has an account-level tag indicating the "teamC" department
+
+  * A cost category rule has assigned this cost to the "teamD" department
+
+
+
+
+Each tag is preserved with its unique prefix, allowing you to analyze costs from multiple perspectives simultaneously. This enables you to:
+
+  * Track which resources belong to which teams (`resourceTags/department`)
+
+  * Understand which users from which departments are consuming resources (`userAttribute/Department`)
+
+  * Allocate costs based on account ownership (`accountTag/department`)
+
+  * Apply custom business logic through cost categories (`costCategory/department`)
+
+
+
+