AWS MAP documentation change

Service: MAP · 2026-06-25 · Documentation low

File: MAP/latest/userguide/bedrock-map-tagging.md

Summary

Expanded tagging instructions to include IAM users (previously roles only) and added required permissions

Security assessment

Changes clarify cost allocation tagging procedures and permissions (iam:TagUser, iam:ListUserTags) but contain no evidence of patching a security vulnerability. The focus is operational tracking, not security enhancement.

Diff

diff --git a/MAP/latest/userguide/bedrock-map-tagging.md b/MAP/latest/userguide/bedrock-map-tagging.md
index 391d002c2..3a2a06e03 100644
--- a//MAP/latest/userguide/bedrock-map-tagging.md
+++ b//MAP/latest/userguide/bedrock-map-tagging.md
@@ -28 +28 @@ If both a resource tag and an IAM principal tag are present, the resource tag ta
-Tag the IAM role used for Amazon Bedrock or Amazon Bedrock AgentCore API calls with the `map-migrated` tag. This approach uses IAM principal cost allocation tags, which allows MAP spend tracking without requiring you to create and manage application inference profiles or change your application code. 
+Tag the IAM principal (role or user) used for Amazon Bedrock or Amazon Bedrock AgentCore API calls with the `map-migrated` tag. This approach uses IAM principal cost allocation tags, which allows MAP spend tracking without requiring you to create and manage application inference profiles or change your application code. 
@@ -38 +38 @@ Tag the IAM role used for Amazon Bedrock or Amazon Bedrock AgentCore API calls w
-  4. Your role must have permission to tag IAM roles. If your role has the IAMFullAccess AWS-managed policy attached, you can skip this step. Otherwise, ensure your role has the `iam:TagRole` and `iam:ListRoleTags` permissions.
+  4. Your role must have permission to tag IAM principals. If your role has the IAMFullAccess AWS-managed policy attached, you can skip this step. Otherwise, ensure your role has `iam:TagRole` and `iam:ListRoleTags` permissions (for tagging roles) or `iam:TagUser` and `iam:ListUserTags` permissions (for tagging users).
@@ -74,0 +75,14 @@ Once the IAM role is tagged, all Amazon Bedrock and AgentCore API calls made usi
+###### Tagging IAM Users
+
+If your application calls Amazon Bedrock using an IAM user rather than an IAM role, tag the user instead:
+    
+    
+    $ aws iam tag-user --user-name MyBedrockUser --tags "Key=map-migrated,Value=migYOUR_MPE_ID"
+
+Verify with:
+    
+    
+    $ aws iam list-user-tags --user-name MyBedrockUser
+
+MAP spend tracking recognizes the `map-migrated` tag on any IAM principal that appears on an eligible billing line.
+
@@ -76,0 +91,2 @@ Once the IAM role is tagged, all Amazon Bedrock and AgentCore API calls made usi
+  * **Supported principal types** : Both IAM roles and IAM users are supported. Tag whichever principal your application uses to invoke Amazon Bedrock APIs.
+