AWS tutorial: Track and limit Bedrock spending by IAM principal
Understand this story
AWS published a tutorial on how to use AWS native features to track and limit Amazon Bedrock generative AI spending by IAM principal. AWS says that in common scenarios no application code is required. The solution is based on Cost Explorer; if only regular reports are needed, the export step can be skipped. CUR 2.0 detail exports and query export data are both optional, used respectively for detail-line analysis and queries. Spending limits can be configured to execute automatically: after selecting Yes, the system automatically runs the limiting action. A follow-up article adds that Bedrock can trace each inference call to the IAM principal that initiated it and write identity and organization tags into CUR 2.0 and Cost Explorer. AWS says tags take up to 24 hours to appear and 48 hours to become visible in CUR 2.0 and Cost Explorer, and that enabling is not retroactive; using Athena queries is billed by data scanned.
AI overview based on source reports · Updated 18 hr ago
Coverage timeline
Follow the coverage to explore different perspectives.
- AWS Machine Learning BlogCost attribution and controls for AI developer and productivity tools on Amazon Bedrock
Amazon Bedrock records the IAM principal behind every inference call and publishes it to CUR 2.0 and Cost Explorer, so per-user and per-team spend can be queried without instrumenting individual tools. The post walks through configuring IAM Identity Center with an external IdP, session tags, a Bedrock permission set, tool configuration for Claude Code, Claude Desktop, Codex and ChatGPT Work, and Athena queries, then compares usage controls from AWS Budgets to gateway-level enforcement.
- AWS Machine Learning BlogTokenomics at scale: Track and cap Amazon Bedrock spend per IAM principal with CUR 2.0 and AWS Budgets
This AWS post describes how to get per-identity Amazon Bedrock cost visibility and enforceable spend limits using only AWS-native features: IAM principal and session tags for attribution, Cost Explorer or CUR 2.0 exports (with the caller identity option) for reporting, and AWS Budgets with budget actions that attach a Deny IAM policy when a threshold is crossed. It notes that budget data refreshes up to three times a day, cost allocation tags are not retroactive, and a Deny action on a shared role blocks everyone using it.
Activity for this story
- Current comparable activity
- 6
- Peak comparable activity
- 10Nov 14 03:00
- Change in the past 24 hours
- -2%
Trends compare the same fully observed participants, which may cover fewer participants than current activity. Move the pointer or tap the chart to inspect hourly activity; use the left and right arrow keys with a keyboard.