Tokenomics at scale: Track and cap Amazon Bedrock spend per IAM principal with CUR 2.0 and AWS Budgets

What happened

Amazon Bedrock captures the AWS Identity and Access Management (IAM) principal identity, the IAM user or role , for every inference request. Get per-identity Amazon Bedrock cost visibility and enforceable spend limits using only AWS-native features, with no application code for the common case. Amazon Web Services is a cloud computing company based in Seattle.

Attribute spend with IAM principal tags, report with CUR 2.0 or Cost Explorer, and enforce with AWS Budgets actions that apply a Deny policy when a threshold is crossed. Generative AI spend is hard to attribute.

This approach gives near-real-time control, but it requires code you then own and operate. The approach relies on three things: IAM principal attribution , which Amazon Bedrock records automatically; AWS Cost and Usage Reports (CUR) 2.0 or AWS Cost Explorer for reporting; and AWS Budgets with budget actions for enforcement.

Solution overview The solution has three parts: attribute, report, and enforce. This happens automatically, with no change to your Amazon Bedrock model inference calls.

If several people share one role, you add per-user detail with session tags passed at role assumption time. If each person or application has its own role, principal tags on the role are enough.

Activate those tags as cost allocation tags, then read the data either in Cost Explorer for a console-only view, or in a CUR 2.0 data export for detailed line-item analysis and SQL queries. Create an AWS Budget scoped to Amazon Bedrock and filtered to one identity or tag value, then attach a budget action that applies a Deny IAM policy when the threshold is crossed.