Calculating Tenant COGS: Attribution of Cloud Infrastructure Costs in Shared Architecture

In the venture-backed cloud platform ecosystem, software businesses are prized for their high gross margins. Software does not require physical factories, warehouse inventory, or shipping fleets; an incremental customer costs pennies to serve. Public benchmarks demand that elite enterprise cloud platform companies maintain gross margins between 75% and 85%.

Yet behind aggregate financial reports, many cloud platform executives harbor a dangerous blind spot: they measure cloud costs only as a monolithic monthly bill (e.g. "Our AWS bill is $50,000 this month").

When engineering teams actually attribute that shared infrastructure down to individual customers, they discover alarming realities:

• A customer paying $500/month on a legacy flat-rate plan is consuming $2,400/month in OpenAI API tokens, multi-region database replication, and cross-AZ network egress.
• Your sales team celebrates signing a "marquee logo" for $50,000/year, unaware that the customer's intensive nightly data pipelines cost your company $70,000/year to host.
• One customer's negative 40% gross margin is quietly eroding the profits generated by 200 smaller, highly profitable accounts.

To protect enterprise profitability, you must build a Tenant COGS (Cost of Goods Sold) Attribution Pipeline. This guide presents the FinOps mathematical allocation formulas, telemetry instrumentation hooks, and cloud invoice decomposition techniques needed to measure per-tenant unit margins accurately.

What Belongs in cloud platform COGS?

Under US GAAP and international financial accounting standards, Cost of Goods Sold includes all direct expenses required to deliver and maintain the production software service:

+-------------------------------------------------------------------------+
| INCLUDED IN cloud platform COGS (Direct Operational Costs)                         |
| • Cloud Hosting Infrastructure (AWS EC2/EKS, RDS, S3, Edge CDN)        |
| • Third-Party Embedded APIs (Twilio SMS, OpenAI LLMs, SendGrid Email)   |
| • Payment Gateway Fees (Stripe interchange and merchant percentages)     |
| • Customer Support & Customer Success Engineer Salaries                  |
| • Site Reliability Engineering (SRE) & Production DevOps Salaries       |
+-------------------------------------------------------------------------+
| EXCLUDED FROM cloud platform COGS (Operating Expenses - OpEx)                     |
| • Feature Development Engineers & Product Managers (Booked as R&D)      |
| • Sales Commissions, Account Executives, & Marketing (Booked as S&M)     |
| • Executive Salaries, Office Leases, & Legal Counsel (Booked as G&A)     |
+-------------------------------------------------------------------------+

The Mathematical Attribution Model

When infrastructure is completely physically isolated (e.g. database-per-tenant on separate RDS instances), cost attribution is trivial: you sum the AWS resource cost tags matching that tenant ID.

In high-efficiency multi-tenant architectures where compute, databases, and network pipes are shared, you must allocate costs proportionally based on measured consumption telemetry weights:

$$\text{COGS}t = \left( C{\text{compute}} \times \frac{\text{CPU}t}{\text{CPU}{\text{tot}}} \right) + \left( C_{\text{db}} \times \frac{\text{DBTime}t}{\text{DBTime}{\text{tot}}} \right) + \left( C_{\text{storage}} \times \frac{\text{GB}t}{\text{GB}{\text{tot}}} \right) + \left( C_{\text{egress}} \times \frac{\text{BytesOut}t}{\text{BytesOut}{\text{tot}}} \right) + C_{\text{direct_apis}}$$

Where:

• $C_{\text{compute}}$: The monthly AWS EC2/EKS container bill.
• $\text{CPU}_t$: Total CPU core-seconds consumed by tenant $t$'s requests.
• $C_{\text{db}}$: The monthly Amazon RDS/Aurora PostgreSQL bill.
• $\text{DBTime}_t$: Total query execution time attributed to tenant $t$.
• $C_{\text{direct_apis}}$: Third-party API charges directly incurred by tenant $t$ (e.g. OpenAI token usage).

Distributing the Idle Buffer Capacity

No production cloud cluster runs at 100% capacity; clusters maintain a 30% to 50% idle buffer for high availability and failover.

FinOps best practice dictates that unallocated idle overhead must be redistributed proportionally across all tenants based on their active consumption share. This ensures that 100% of your cloud provider's invoice is reconciled down to the penny.

Telemetry Collection: Measuring Tenant Resource Consumption

How do you measure a tenant's fractional share of database CPU and container memory?

1. Database Query Execution Time

Configure your application connection pool to wrap database transactions with a lightweight OpenTelemetry span or session timer:

func QueryWithAttribution(ctx context.Context, db *sql.DB, tenantID string, query string, args ...any) (*sql.Rows, error) {
	start := time.Now()
	rows, err := db.QueryContext(ctx, query, args...)
	duration := time.Since(start)

	// Emit metric to Prometheus / OpenTelemetry Collector
	// Key: tenant_db_duration_seconds{tenant_id="c1209b55..."}
	recordTenantDBMetric(tenantID, duration.Seconds())

	return rows, err
}

2. Network Egress Attribution

In your HTTP logging middleware, record the response payload size:

func LoggingMiddleware(next http.Handler) http.Handler {
	return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
		rw := &responseSizeTracker{ResponseWriter: w}
		next.ServeHTTP(rw, r)

		tenant := GetTenant(r.Context())
		if tenant != nil {
			// Record byte egress attributed to this customer
			recordTenantEgressMetric(tenant.ID, rw.bytesWritten)
		}
	})
}

Production Unit Economics: Analyzing Customer Gross Margins

Once your monthly pipeline processes the AWS Cost and Usage Report (CUR) alongside your telemetry database, compute the Customer Gross Margin:

$$\text{Gross Margin}_t = \frac{\text{MRR}_t - \text{COGS}_t}{\text{MRR}_t}$$

Let us examine real customer unit economics from a mid-market cloud platform:

Taking Action on Negative-Margin Accounts

When you identify an account like Hooli Labs (generating $250/mo but costing $840/mo in infrastructure):

1. Analyze the Root Cause: Did the customer configure a webhook poller without pagination? Are they storing 50 terabytes of uncompressed debug logs?
2. Present Telemetry Evidence: When contract renewal arrives, show the customer their actual compute consumption. Explain that their volume exceeds standard tier boundaries.
3. Restructure the Contract: Transition the customer to a consumption-based contract with rate limits or introduce an overage pricing tier.

Handling Third-Party AI APIs and Token Attribution

Modern cloud software platforms increasingly integrate external generative AI providers (e.g. OpenAI, Anthropic, or self-hosted vLLM clusters on AWS EC2 p4de.24xlarge instances). Unlike shared relational databases, third-party model inference incurs direct variable costs per thousand input and output tokens:

1. Proxy Gateway Metering: Route all upstream AI requests through an internal reverse proxy that logs the authenticated tenant_id, model family (claude-3-5-sonnet, gpt-4o), prompt tokens, completion tokens, and latency.
2. Real-Time Cost Derivation: Calculate the exact financial cost at response completion:
   $$\text{Inference Cost} = (\text{Prompt Tokens} \times P_{\text{in}}) + (\text{Completion Tokens} \times P_{\text{out}})$$
3. Caching and Amortization: Track tenant cache hit rates. When semantic prompt caching returns an immediate response without calling the upstream provider, record the compute saving and adjust the tenant's margin attribution accordingly.

Cross-AZ and Cross-Region Network Egress Accounting

Cloud providers quietly charge substantial fees for network data transfer:

• Inter-Availability Zone Traffic: AWS charges $0.01 per GB for traffic crossing AZ boundaries within the same VPC. High-throughput distributed caches (e.g. Redis clusters) can generate thousands of dollars in surprise inter-AZ bandwidth fees.
• Internet Egress: Pushing gigabytes of raw analytics exports, customer backups, or file downloads to external client networks ranges from $0.05 to $0.09 per GB.

To attribute network costs accurately:

• Extract bytes_sent from Envoy or NGINX ingress access logs tagged with x-tenant-id.
• Attribute CDN egress costs by querying edge CDN or Amazon CloudFront usage logs grouped by tenant-specific API key headers.
• Encourage tenants running massive automated bulk exports to configure AWS S3 Same-Region replication or point-to-point VPC Peering, dramatically reducing edge egress surcharges.

Practical Next Steps

1. Tag All Dedicated Cloud Resources: Ensure all dedicated databases, S3 buckets, and VPCs are tagged with TenantID in AWS.
2. Instrument Application Telemetry: Log query duration and egress bytes tagged with tenant_id on all HTTP endpoints.
3. Capture AI Token Usage at the Gateway: Record prompt and completion token counts on every inference call per tenant.
4. Process AWS Cost and Usage Reports (CUR): Build a monthly pipeline that imports your cloud CUR billing export into DuckDB or Snowflake.
5. Publish Customer Margin Dashboards: Give your executive team and customer success managers monthly reports ranking accounts by net gross margin.