Setting up your tax information

You can use the Tax settings page under Preferences and Settings in the left navigation of your AWS Billing and Cost Management console. Use this page to manage your tax registration numbers, turn on tax setting inheritance so your tax registration information is aligned across your Organizations accounts, and manage your tax exemptions. This page also shows how you can set up your Amazon S3 buckets to use your Tax Settings API.

Updating and deleting tax registration numbers

Use the following steps to update or delete one or more tax registration numbers.

You can remove one or more tax registration numbers.

Turning on tax setting inheritance

You can use your tax registration information with your member accounts by turning on your Tax settings inheritance. After you activate it, your tax registration information is added to your other AWS Organizations accounts, saving you the effort of registering redundant information. Tax invoices are processed with the consistent tax information, and your usage from member accounts will consolidate to a single tax invoice.

Tax registration information includes:

Managing your US tax exemptions

If your state is eligible, you can manage your US tax exemptions on the Tax settings page. The documents you upload for the exemption are reviewed by AWS Support within 24 hours.

Within 24 hours, AWS Support will notify you through a support case if they need additional information, or if any of your documents weren't valid.

Once the exemption is approved, you can view it under the Tax exemption tab with an Active validity period.

You will be notified through a support case contact if your exemption was rejected.

Setting up your Amazon S3 to use your Tax Settings API

Follow this procedure so that the Tax Settings API has permission to send your tax documents to an Amazon S3 bucket. You can then download the tax document from your Amazon S3 bucket. You only need to do this procedure for the following countries that require a tax registration document:

For all other countries, you don’t need to specify a tax registration document. If you call the Tax Settings API and provide a tax registration document in your request, the API will return a ValidationException error message.

The following Tax Settings API operations require access to your Amazon S3 bucket:

Adding resource policies to your Amazon S3 bucket

To allow the Tax Settings API to access the object in your Amazon S3 bucket, add the following resource policies in your Amazon S3 bucket.

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Sid": "Allow the Tax Settings API to access objects",
            "Effect": "Allow",
            "Principal": {
                "Service": "tax.amazonaws.com"
            },
            "Action": [
                "s3:GetObject"
            ],
            "Resource": "arn:aws:s3:::amzn-s3-demo-bucket1/*",
            "Condition": {
                "StringEquals": {
                    "aws:SourceArn": "arn:aws:tax:us-east-1:${AccountId}:*",
                    "aws:SourceAccount": "${AccountId}"
                }
            }
        }
    ]
}

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Sid": "Allow the Tax Settings API to access objects",
            "Effect": "Allow",
            "Principal": {
                "Service": "tax.amazonaws.com"
            },
            "Action": [
                "s3:PutObject"
            ],
            "Resource": "arn:aws:s3:::amzn-s3-demo-bucket1/*",
            "Condition": {
                "StringEquals": {
                    "aws:SourceArn": "arn:aws:tax:us-east-1:${AccountId}:*",
                    "aws:SourceAccount": "${AccountId}"
                }
            }
        }
    ]
}

AWS KMS managed key policy

If your S3 bucket is encrypted with AWS KMS managed key (SSE-KMS), add the following permission to the KMS key. This permission is required for the following API operations:

{
    "Version": "2012-10-17",
    "Id": "key-consolepolicy-3",
    "Statement": [
        {
            "Sid": "Allow the Tax Settings API to access objects",
            "Effect": "Allow",
            "Principal": {
                "Service": "tax.amazonaws.com"
            },
            "Action": [
                "kms:Decrypt",
                "kms:GenerateDataKey*"
            ],
            "Resource": "*",
            "Condition": {
                "StringEquals": {
                    "aws:SourceArn": "arn:aws:tax:us-east-1:${YOUR_ACCOUNT_ID}:*",
                    "aws:SourceAccount": "${YOUR_ACCOUNT_ID}"
                }
            }
        }
    ]
}