FinOps Center tracks every eligible billing entity — infrastructure resources for standard MAP, inference profiles for MAP AI — through its lifecycle from eligibility confirmation through credit receipt. No migration dollar goes unclaimed. No Product Owner decides what's eligible. The system derives it all.
MAP credits don't arrive automatically. They accrue based on eligible spend against resources tagged with the MAP cost allocation tag. If a resource is missing the tag, that spend doesn't count — and the credit doesn't arrive. Most teams don't find out until the milestone report lands short.
When credits do arrive, they're applied at the consolidated billing level — pooled across every linked account. The product team whose migration workload earned the credit has no native way to see their share. Finance reverse-engineers it manually, month after month.
For MAP AI, the problem compounds. Bedrock has no taggable resource ARN — the tag lives on an Application Inference Profile your application may not even be routing through yet. AI workload spend that looks perfectly attributable to a team may be invisible to MAP accrual because no one created the profile, or no one tagged it, or someone tagged it and the tag drifted.
FinOps Center closes both gaps. Every billing entity is tracked through a defined lifecycle. Every credit is matched to the workload that earned it. Every role sees the number relevant to their work.
FinOps Leads create MAP contracts directly inside FinOps Center using a guided four-step wizard. Select eligible services using Standard or AI Modernization defaults, define accounts in scope, and configure auto-enrollment rules — all without leaving the platform.
One-click to apply the standard MAP eligible service set — EC2, Lambda, EKS, RDS, DynamoDB, S3. No manual checklist required.
Adds Amazon Bedrock and SageMaker to the eligible set. Applies when your MAP contract covers AI workload migration as well as infrastructure.
When Bedrock is selected as an eligible service, FinOps Center automatically evaluates every AI workload in covered accounts against inference profile coverage and generates the appropriate Cloud Engineer task per workload — Create Profile, Add to Profile, or Tag Profile. No separate reminder needed. No manual inventory required.
Once a FinOps Lead creates a MAP contract for an account, every eligible billing entity in that account is automatically evaluated against the contract. Product Owners creating workloads in Spaces never see a “MAP AI Workload” option, never pick a contract, never classify their own spend. They claim what they own. The rollup does the rest.
Eligibility derived from the resource ARN. Cloud Engineer tags the infrastructure resource.
Eligibility derived from the Application Inference Profile. Cloud Engineer creates and tags the profile.
One rule, two billing entities. Zero manual classification. The Product Owner sees their credit attribution; they never touch the derivation logic that produced it.
FinOps Center assigns a lifecycle state to every billing entity that appears in your CUR as MAP-eligible. That state determines whether credit is accruing, at risk, or lost.
Billing entity (resource ARN or inference profile) confirmed in CUR as MAP-eligible. mapEligibilityDate is set on first CUR confirmation. The clock starts here.
Eligible but untagged. For infrastructure, the resource ARN lacks the map-migrated tag. For AI, either the application is not routing through an inference profile at all, or the profile exists but lacks the tag. Every day in this state is spend that won't accrue MAP credits. FinOps Center surfaces these immediately to the assigned Cloud Engineer.
MAP cost allocation tag confirmed present and correct on the relevant billing entity (resource ARN or inference profile). Spend is accruing toward MAP credit milestones.
Tag was present but has drifted — removed, overwritten, or altered. A CloudEngineeringTask is auto-created. Credit accrual stops until resolved. For AI workloads, this also fires if an application stops routing through a tagged inference profile and falls back to direct model invocation.
Tag was present but has drifted — removed, overwritten, or altered. A CloudEngineeringTask is auto-created. Credit accrual stops until resolved.
For infrastructure MAP, the Cloud Engineer action is always “tag the resource.” For MAP AI, the required action depends on the application's current state.
Application is invoking Bedrock directly, without an inference profile.
Create an Application Inference Profile for the model/region combination, tag it map-migrated, update the application to route through the profile ARN.
An inference profile exists but this application is not routing through it.
Update the application to route through the existing profile ARN. No new profile required.
The inference profile exists and is in use, but the map-migrated tag is missing or has drifted.
Apply or reapply the map-migrated tag to the existing inference profile.
All three task types are auto-generated by the nightly pipeline based on the observed state of each AI workload's Bedrock usage pattern in CUR.
When your CUR lands in S3 each morning, FinOps Center's pipeline processes every charge line — confirming eligibility, verifying tags, matching MAP credits via the mig* promotion code pattern, and updating every role's view before the workday starts.
CUR2 file lands in S3 ~7am daily
Event-driven trigger on S3 object creation
Tags verified, eligibility states updated, drift detected
promotionCode matching mig* pattern, expiry-first pooling applied
MAP Compliance Rate updated per team, portfolio, product
Agent Bill and dashboards reflect today's MAP state by morning
CUR2 file lands in S3 ~7am daily
Event-driven trigger on S3 object creation
Tags verified, eligibility states updated, drift detected
promotionCode matching mig* pattern, expiry-first pooling applied
MAP Compliance Rate updated per team, portfolio, product
Agent Bill and dashboards reflect today's MAP state by morning
For accounts where 100% of spend is allocated to a single MAP workload, FinOps Center automatically claims credits without requiring manual attribution. Finance teams see the correct numbers without the manual reconciliation.
A TAGGED billing entity doesn't stay TAGGED automatically. Infrastructure changes, tag overwrites, and configuration updates all cause drift. FinOps Center detects it on the next pipeline run and acts.
On the nightly pipeline run, FinOps Center finds that a billing entity's MAP tag has been removed, altered, or overwritten. The state transitions from TAGGED → STALE_TAG immediately.
A task is auto-created and assigned to the Cloud Engineer responsible. The task includes the resource ID or profile ARN, the last known correct tag value, the date drift was detected, and the MAP credit accrual impact per day unresolved.
Once the tag is corrected, the next pipeline run confirms it in CUR and transitions the entity back to TAGGED. The task closes automatically. Credit accrual resumes for subsequent spend.
Every persona in FinOps Center sees the MAP data relevant to their work — not the full billing complexity, not a generic dashboard. RBAC enforces the scope at the data layer.
Compliance rate, credit attribution, at-risk spend, open tagging tasks — Agent Bill answers at every level of your hierarchy, in plain language, in real time.
“How much MAP credit have we claimed this month versus what we projected?”
You've claimed $47,200 in MAP credits month-to-date against a $52,000 projection. The gap is 3 resources in PENDING_TAG state in the Platform portfolio — $4,800 in daily eligible spend that isn't accruing. Two are Cloud Engineer–assigned tasks opened today. The third was tagged yesterday but the pipeline hasn't confirmed it yet — it will resolve tonight.
MAP Compliance Rate contributes to every team's CFM Scoreboard grade alongside CFM Efficiency Score, EDP Tracking, and Resource Ownership. A low MAP compliance rate drags the overall grade — making MAP tagging visible to leadership in the same weekly review where they see cloud spend. For AI-heavy portfolios, inference profile coverage drives this metric as much as resource-level tagging — both surface in the same Scoreboard, under the same MAP Compliance Rate signal.
See the CFM ScoreboardYour CUR data, your MAP tags, your credit history — none of it leaves your environment. The nightly pipeline runs in your Lambda. The Scoreboard data lives in your QuickSight SPICE. FinOps Center is a tenant in your account, not a pipeline to ours.
FinOps Center deploys in minutes from the AWS Marketplace. Your MAP lifecycle tracking starts on the first CUR landing.
