Tokenomics at scale: Track and cap Amazon Bedrock spend per IAM principal with CUR 2.0 and AWS Budgets

This AWS post describes how to get per-identity Amazon Bedrock cost visibility and enforceable spend limits using only AWS-native features: IAM principal and session tags for attribution, Cost Explorer or CUR 2.0 exports (with the caller identity option) for reporting, and AWS Budgets with budget actions that attach a Deny IAM policy when a threshold is crossed. It notes that budget data refreshes up to three times a day, cost allocation tags are not retroactive, and a Deny action on a shared role blocks everyone using it.