Amazon Bedrock has added a zero‑instrumentation cost attribution layer that automatically tags each model inference with the caller’s IAM identity and any session tags. The data appears in the line_item_iam_principal column of CUR 2.0 and as filterable dimensions in Cost Explorer, staying within the AWS security boundary. Practitioners can now answer per‑user cost questions, correlate spend with team outcomes, and plan budgets with real usage data.
Built‑in per‑user cost attribution
When a model is invoked through the bedrock-runtime or bedrock-mantle endpoint, Bedrock captures the full IAM ARN of the caller, including the federated session name, and writes it to CUR 2.0. Aggregation occurs per principal and per usage type for each export interval (hourly or daily). Optional session tags supplied during federation are prefixed with iamPrincipal/ and become first‑class cost allocation tags. No changes to API calls or SDK usage are required.
Enabling the feature
To activate per‑user attribution you must:
- Enable AWS IAM Identity Center in the management account.
- Connect your external identity provider (e.g., Okta) so that each sign‑in creates a unique session name.
- Configure session tags (team, cost center, project) to flow with the federated session.
- Ensure CUR 2.0 is enabled and exported to an S3 bucket for Athena queries.
Once identity propagation is set up, any AI coding or productivity tool that routes inference through Bedrock—Claude Code, Claude Desktop, OpenAI Codex, ChatGPT Work, OpenCode—inherits the attribution automatically.
Operational and security implications
The attribution mechanism keeps all billing metadata inside AWS, avoiding external data pipelines. Engineers gain a reliable source for cost dashboards and can build Athena queries that join line_item_iam_principal with session tags to produce per‑user or per‑team spend reports. For finer‑grained analysis, Bedrock also supports per‑request metadata tagging, which appears in model invocation logs and can provide token‑level cost detail.
From a security perspective, the approach relies on correct IAM Identity Center configuration. Misconfigured federation or static session names would collapse multiple users into a single principal, erasing visibility. Tag policies should be reviewed to prevent accidental tag omission that would hinder cost allocation. Bedrock’s native usage controls can enforce spending limits, offering an additional safeguard against runaway consumption.
Related CloudNinjas coverage: AWS.
What This Means For Practitioners
- Adopt IAM Identity Center with federated session names to guarantee unique principal attribution.
- Define and enforce a minimal set of session tags (e.g.,
team,cost_center) to enable cost allocation without extra instrumentation. - Integrate CUR 2.0 exports into existing Athena or Cost Explorer dashboards to surface per‑user AI spend.
- Consider enabling per‑request metadata tagging for workloads that need prompt‑level cost insight.
- Review Bedrock usage controls and set spend caps aligned with team budgets to prevent unexpected charges.
