# Setting up your tax information You can use the **Tax settings** page under **Preferences and Settings** in the left navigation of your AWS Billing and Cost Management console. Use this page to manage your tax registration numbers, turn on tax setting inheritance so your tax registration information is aligned across your Organizations accounts, and manage your tax exemptions. This page also shows how you can set up your Amazon S3 buckets to use your Tax Settings API. When you use billing transfer, the bill transfer account controls the tax settings of the AWS Organizations (management and linked accounts) that transfer their bill. The management account of the AWS organization that transfers its bill (bill source account) can still configure tax settings for its AWS organization. However, these settings don't apply while billing transfer is active. ## Updating and deleting tax registration numbers Use the following steps to update or delete one or more tax registration numbers. **Note** If a country isn't listed in the **Tax settings** page dropdown, AWS doesn't collect tax registration for that country at this time. **To update tax registration numbers** 1. Sign in to the AWS Management Console and open the AWS Billing and Cost Management console at [https://console.aws.amazon.com/costmanagement/](https://console.aws.amazon.com/costmanagement/). 1. In the navigation pane, choose **Tax settings**. 1. Under **Tax registrations**, select the numbers to edit. 1. For **Manage tax registration**, choose **Edit**. 1. Enter your updated information and choose **Update**. You can remove one or more tax registration numbers. **To delete tax registration numbers** 1. Sign in to the AWS Management Console and open the AWS Billing and Cost Management console at [https://console.aws.amazon.com/costmanagement/](https://console.aws.amazon.com/costmanagement/). 1. In the navigation pane, choose **Tax settings**. 1. Under **Tax Registrations**, select the tax registration numbers to delete. 1. For **Manage tax registration**, choose **Delete TRN**. 1. In the **Delete tax registration** dialog box, choose **Delete**. ## Turning on tax setting inheritance You can use your tax registration information with your member accounts by turning on your **Tax settings inheritance**. After you activate it, your tax registration information is added to your other AWS Organizations accounts, saving you the effort of registering redundant information. Tax invoices are processed with the consistent tax information, and your usage from member accounts will consolidate to a single tax invoice. **Notes** Tax inheritance settings are only available to accounts after a member account is added. If you turn off tax inheritance, the member accounts revert to the account's original TRN setting. If there was no TRN originally set for the account, no TRN will be assigned. If you use billing transfer, tax inheritance works across multiple AWS Organizations. By default, the bill transfer account's tax information applies to invoices of AWS Organizations that transfer their bills. The bill transfer account can use the invoice configuration functionality to assign different tax settings to AWS Organizations that transfer their bills. Tax registration information includes: + Business legal name + Tax address + Tax registration number + Special exemptions **To turn on tax setting inheritance** 1. Sign in to the AWS Management Console and open the AWS Billing and Cost Management console at [https://console.aws.amazon.com/costmanagement/](https://console.aws.amazon.com/costmanagement/). 1. In the navigation pane, choose **Tax settings**. 1. Under **Tax registrations**, select **Enable tax settings inheritance**. 1. In the dialog box, choose **Enable**. ## Managing your US tax exemptions If your state is eligible, you can manage your US tax exemptions on the **Tax settings** page. The documents you upload for the exemption are reviewed by Support within 24 hours. **Note** You must have IAM permissions to view the **Tax exemptions** tab on the **Tax settings** page in the Billing and Cost Management console. For an example IAM policy, see [Allow IAM users to view US tax exemptions and create Support cases](billing-example-policies.md#example-awstaxexemption). **To upload or add your US tax exemption** 1. Sign in to the AWS Management Console and open the AWS Billing and Cost Management console at [https://console.aws.amazon.com/costmanagement/](https://console.aws.amazon.com/costmanagement/). 1. In the navigation pane, choose **Tax settings**. 1. Choose **Tax exemptions**. 1. Choose all of the accounts to add the tax exemption. Choose **Manage tax exemption** and select **Add tax exemption**. 1. If you're logged in as a linked account, you can add tax exemptions to only the linked account. 1. If you're logged in as a payer account, you can add tax exemptions to both payer and linked accounts. 1. If you use billing transfer and logged in as the billing transfer account, you can add a tax exemption that applies to all AWS Organizations that transfer their bills by adding the exemption to your bill transfer account. To apply a tax exemption to only some AWS Organizations that transfer their bills, use invoice configuration to assign a linked account under your bill transfer account as the invoice receiver. Then add a tax exemption to that linked account. 1. Specify your exemption type and jurisdiction. 1. Upload certificate documents. 1. Review your information, and choose **Submit**. **Note** Billing transfer currently doesn't support tax exemption for individual linked accounts in AWS Organizations that transfer their bills. To add a tax exemption for a specific linked account, the bill source account owner must remove the account from its AWS organization and create a separate AWS organization with that account. After creating the new AWS organization, the owner can set up billing transfer and add the tax exemption using the standard billing transfer process. Within 24 hours, Support will notify you through a support case if they need additional information, or if any of your documents weren't valid. Once the exemption is approved, you can view it under the **Tax exemption** tab with an **Active** validity period. You will be notified through a support case contact if your exemption was rejected. ## Setting up your Amazon S3 to use your Tax Settings API Follow this procedure so that the [Tax Settings API](https://docs.aws.amazon.com/aws-cost-management/latest/APIReference/API_Operations_Tax_Settings.html) has permission to send your tax documents to an Amazon S3 bucket. If you use billing transfer, you can use the tax settings API with your bill transfer account to send tax documents to your Amazon S3 bucket for AWS Organizations that transfer their bills. You can then download the tax document from your Amazon S3 bucket. You only need to do this procedure for the following countries that require a tax registration document: + BD: Bangladesh + KE: Kenya + KR: South Korea + ES: Spain For all other countries, you don’t need to specify a tax registration document. If you call the Tax Settings API and provide a tax registration document in your request, the API will return a `ValidationException` error message. The following Tax Settings API operations require access to your Amazon S3 bucket: + `BatchPutTaxRegistration`: Requires access to read the Amazon S3 bucket + `PutTaxRegistration`: Requires access to read the Amazon S3 bucket + `GetTaxRegistrationDocument`: Requires access to write to the Amazon S3 bucket ### Adding resource policies to your Amazon S3 bucket To allow the Tax Settings API to access the object in your Amazon S3 bucket, add the following resource policies in your Amazon S3 bucket. **Example For `BatchPutTaxRegistration` and `PutTaxRegistration`** Replace *DOC-EXAMPLE-BUCKET1* with the name of your bucket. **** ``` { "Version":"2012-10-17", "Statement": [ { "Sid": "Allow the Tax Settings API to access objects", "Effect": "Allow", "Principal": { "Service": "tax.amazonaws.com" }, "Action": [ "s3:GetObject" ], "Resource": "arn:aws:s3:::amzn-s3-demo-bucket1/*", "Condition": { "StringEquals": { "aws:SourceArn": "arn:aws:tax:us-east-1:${AccountId}:*", "aws:SourceAccount": "${AccountId}" } } } ] } ``` **Example For `GetTaxRegistrationDocument`** Replace *amzn-s3-demo-bucket1* with the name of your bucket. **** ``` { "Version":"2012-10-17", "Statement": [ { "Sid": "Allow the Tax Settings API to access objects", "Effect": "Allow", "Principal": { "Service": "tax.amazonaws.com" }, "Action": [ "s3:PutObject" ], "Resource": "arn:aws:s3:::amzn-s3-demo-bucket1/*", "Condition": { "StringEquals": { "aws:SourceArn": "arn:aws:tax:us-east-1:${AccountId}:*", "aws:SourceAccount": "${AccountId}" } } } ] } ``` **Note** For the classic AWS Regions (`aws` partition), the `aws:SourceArn` will be: `arn:aws:tax:us-east-1:{YOUR_ACCOUNT_ID}:*` For the China Regions (`aws-cn` partition), the `aws:SourceArn` will be: `arn:aws-cn:tax:cn-northwest-1:{YOUR_ACCOUNT_ID}:*` **To allow the Tax Settings API access to your S3 bucket** 1. Go to the [Amazon S3 console](https://s3.console.aws.amazon.com/s3/home?region=us-east-1) and sign in. 1. Choose **Buckets** from the left navigation, and then choose your bucket from the list. 1. Choose the **Permissions** tab, then, next to **Bucket policy**, choose **Edit**. 1. In the **Policy** section, add the policies to the bucket. 1. Choose **Save changes** to save your policy, attached to your bucket. Repeat for each bucket that encrypts an S3 bucket that Tax Settings needs to access. ### AWS KMS managed key policy If your S3 bucket is encrypted with AWS KMS managed key (SSE-KMS), add the following permission to the KMS key. This permission is required for the following API operations: + `BatchPutTaxRegistration` + `PutTaxRegistration` + `GetTaxRegistrationDocument` ------ #### [ JSON ] **** ``` { "Version":"2012-10-17", "Id": "key-consolepolicy-3", "Statement": [ { "Sid": "Allow the Tax Settings API to access objects", "Effect": "Allow", "Principal": { "Service": "tax.amazonaws.com" }, "Action": [ "kms:Decrypt", "kms:GenerateDataKey*" ], "Resource": "*", "Condition": { "StringEquals": { "aws:SourceArn": "arn:aws:tax:us-east-1:${YOUR_ACCOUNT_ID}:*", "aws:SourceAccount": "${YOUR_ACCOUNT_ID}" } } } ] } ``` ------ **To give Tax Settings access to AWS KMS for SSE-KMS encrypted S3 buckets** 1. Go to the [Amazon S3 console](https://s3.console.aws.amazon.com/s3/home?region=us-east-1) and sign in. 1. Choose **Customer managed keys** from the left navigation, and then choose the key that is used to encrypt your bucket from the list. 1. Select **Switch to policy view**, then choose **Edit**. 1. In the **Policy** section, add the AWS KMS policy statement. 1. Choose **Save changes** to save your policy, attached to your key. Repeat for each key that encrypts an S3 bucket that Tax Settings needs to access.