Amazon Web Services (AWS)

As of December 2015, a new enterprise agreement has been negotiated between Amazon Web Services (AWS) and Columbia University. The agreement provides a number of benefits, most notably the ability to pay for AWS services in a manner that is in compliance with University procurement policy.

All faculty and administrators who use AWS for Columbia purposes are required to have an AWS account through the University Enterprise Agreement.

To receive these benefits:

  • If you already have an AWS account that you use for Columbia business and pay for with a personal credit card or a P-Card, then you will need to link your account to the University’s Enterprise Agreement. Linking your account to the University’s Enterprise Agreement also provides intellectual property, liability and other protections.
  • If you do not already have an AWS account, you will need to request one through CUIT’s Enterprise Agreement.

Keep in mind:

  • For compliance with the University’s Acceptable Use Policy and data classification policies, we ask that users who link their accounts complete a simple request form as part of the linking procedures. 
  • Because Columbia does not have a Business Associate Agreement (BAA) with Amazon Web Services, AWS cannot be used to store or share PHI data.

Frequently Asked Questions

 

Using AWS Through the Columbia University Enterprise Agreement

Billing

Benefits of the University Enterprise Agreement

AWS Services Usage

Student Use

Using AWS Through the Columbia University Enterprise Agreement

What happens when I request a new Amazon Web Services (AWS) account through the University Enterprise Agreement?

Requesting a new AWS account through the University Enterprise Agreement will generate a ticket with CUIT to open a new account using the chart string you provide in your request. Within 10 days, CUIT will set up a shell account and billing details for you and will provide you with the details for logging into your new account.

Through your AWS account dashboard, you will work directly with Amazon Web Services to select the features and services you will use within AWS. The cost of your AWS usage is based solely on the services you use within AWS.

What happens when I request to link my existing Amazon Web Services (AWS) account?

Once you have submitted a request to link your existing AWS account to the University Enterprise agreement, CUIT will work with Amazon to have your account migrated to our Enterprise Agreement and charged back to the chart string that you provide in your request. You will continue to access and use your AWS services as you normally do. Only the billing for your account will change.

Billing

Will I be able to change the ARC Chartstring I use for AWS in the future?

Yes, you can change the chartstring you use for this service at any time by sending a service request to the CUIT billing department.

Can I allocate my AWS account charges to more than one chartstring?

CUIT will not split charges for one AWS account across multiple chartstrings. However, there are two options available to allow you to  split your AWS charges:

  • Create ARC journal entries to split your charges across multiple projects as needed. AWS provides powerful cost allocation tags to help you track the cost for  individual AWS services usage which you can then use for your own billing allocation and reconciliation.
  • Optionally, you can create separate AWS accounts for each chartstring and allocate your AWS usage to each account accordingly.

I have a question about my bill.
CUIT will only bill you a single total each month, based on the billing details that AWS provides us based on your usage. As the AWS Account owner you have access to detailed billing information for your account at any time, by visiting the AWS Billing and Cost Management Console. From the dashboard you can see historical invoice details as well as current month-to-date spending, to help you keep track of and manage your account usage and associated costs.

What access do I have to my linked AWS account details in the AWS Billing and Cost Management Console?
As described in the question above about billing, the AWS Billing and Cost Management Console provides historical invoice details, as well as current month-to-date spending specific to your AWS account. All AWS account linked to the University Enterprise Agreement have the following access to the AWS Billing and Cost Management Console:

Console ItemAccess level for linked accounts
DashboardFull Access
BillsFull Access
Cost ExplorerFull Access - though it says ask payer
BudgetsLocked
ReportsAWS Cost and Usage Reports are not available. Other reports are available.
Cost Allocation TagsLocked. Customers will need to contact CUIT to add cost allocation tags.
Payment MethodsFull Access, though the consolidated billing configuration is not visible.
Payment HistoryFull Access, though only history prior to linking is available. Consolidated billing information is not visible.
Consolidated BillingFull Access. Shows the option to unlink billing.
PreferencesLocked
CreditsFull Access
Tax SettingsFull Access
Dev PayAccounts using Dev Pay should contact CUIT before linking.

How do I avoid “runaway” bills?
See the AWS Billing and Cost Management documentation for details. While AWS does not provide a means to cut off service after reaching a threshold, you can set billing alerts with dollar thresholds which will trigger an email to you if those thresholds are exceeded. However, it is your responsibility to manage your account’s usage.

Is my account eligible for the AWS Free Tier?
No. AWS allows only one Free Tier account for consolidated billing, so all linked accounts share in the University’s single consolidated billing free tier for the 12 months beginning December 2015.

What about reserved instances?
AWS shares pricing for unused reserved EC2 and RDS instances among all accounts in the consolidated billing family. The account that purchased the reserved instance gets first “dibs”. If however, there’s extra reserved capacity left over at the end of the month—that would otherwise be forfeited—this capacity is instead shared by any other linked accounts that match (in other words, is of the same server type in the same availability zone). Read more about how this works.

I currently pay for an AWS Support plan. Any changes?
No. Each AWS Account independently subscribes to a support plan level (or Basic Support which is no charge).

Can I get the research data egress waiver?
AWS recently announced (on March 1, 2016) a data egress fee waiver for research use. We are investigating this and will add more information to this FAQ soon.

Benefits of the University Enterprise Agreement

What makes this Enterprise Agreement better than the “click-through” AWS contract?
The Enterprise Agreement negotiated between Columbia and AWS has several improvements of the “standard” AWS agreement. These include:

  • Improved security, privacy and audit protections

  • Branding and intellectual property protection for Columbia University

  • Extended times to “exit” the service should Columbia and AWS decide to part ways

  • Complies with University Procurement and IT Security Policies


AWS services usage

How do I learn how to use AWS?
To get started, AWS provides online and in-person training. We also expect to soon begin coordinating training and information sharing for the Columbia community through a University AWS user group, that is not yet in place. To join the group, please click here.

I currently have an AWS Account. What changes when I “link” to the University Enterprise Agreement?
From a daily use perspective, changes are not significant. We are linking these AWS accounts to Columbia’s master billing account, so your method of payment changes (see Billing-related questions, above) from a credit card to ARC Chartstring. However, we are keeping each customer’s AWS Account (the one with the 12-digit account number) separate rather than attempting to merge multiple customer accounts together – which would be quite difficult and intrusive.

I don’t have an AWS Account yet. What do I do?
If you do not already have an AWS account, and would like an account to use for Columbia University business, simply submit a request through the CUIT Service Catalog. Please note that, per University policy, you will need to provide a chart string for all AWS account billing.

Student Use

Can students join the CU Enterprise Agreement?
No. Student use is not covered for two reasons:

  1. Billing is via ARC Chartstring only

  2. The University will not assume liability for student actions.


What about AWS Educate?
AWS Educate is a program that operates independently of the AWS Enterprise Agreement. It has its own contract and is designed for student and instructor use. AWS Educate provides grants in order to make the cost of learning to use AWS free. However, it currently requires account holders to provide a credit card to cover charges in excess of the grant amount. As such, Columbia University cannot recommend AWS Educate for our students as we cannot and will not require them to take on an unspecific debt risk. We have asked AWS to come up with an approach that would cut off usage in excess of the grant amount, but that capability does not currently exist.