IAM principal cost allocation now supported on the bedrock-mantle endpoint: Amazon Bedrock now supports cost allocation by IAM principal (users and roles) for inference requests made through the bedrock-mantle endpoint, extending the capability previously

IAM Principal Attribution

Amazon Bedrock automatically captures the IAM principal identity (IAM users and IAM roles) for every inference request. Optionally, attach tags to your principals for additional cost dimensions like team, department, or cost center. This provides per-user and per-role cost visibility without code changes or additional resources.

How it works

When an IAM user or role makes an inference request, Amazon Bedrock records the caller's identity. This information flows into AWS Cost Explorer and AWS Cost and Usage Reports (CUR 2.0), where you can filter and group costs by identity. No changes to your Amazon Bedrock API calls are required. Attribution is based on who made the call, not on API parameters.

Principal types

Amazon Bedrock captures identity from any IAM principal type. The two most common are IAM users and IAM roles.

• IAM users call Amazon Bedrock directly using long-lived access keys. The IAM user name and any tags attached to the user are recorded in AWS Billing.
• IAM roles are assumed by users, applications, or federated identities through AWS STS. When a principal calls sts:AssumeRole, the resulting temporary credentials carry the role's identity. Tags can come from two sources:
  • Principal tags – Tags attached directly to the IAM role. These are static and apply to every session.
  • Session tags – Tags passed at the time of role assumption through AWS STS. These are dynamic and can vary per session, making them useful for passing user-specific attributes like email, team, or cost center through a shared role.

Setting up IAM principal attribution

Identity-level attribution (the caller's IAM user or role ARN) is captured automatically for every Amazon Bedrock request. To add organizational dimensions like team or cost center to your billing data, follow these steps to tag your principals and activate the tags in AWS Billing.

Step 1: Apply tags to your IAM principals (optional)

Tags flow to your billing data in two ways:

• Principal tags are attached directly to IAM users or roles. Set them once and they apply to every request from that principal. This is ideal for tagging individual developers (IAM users) or applications (IAM roles).
• Session tags are passed dynamically when assuming an IAM role through AWS STS. They are ideal for federated users and LLM gateways that proxy requests on behalf of multiple users or tenants.

Step 2: Activate cost allocation tags

To make your IAM principal tags appear in AWS Cost Explorer and CUR 2.0, you must activate them as cost allocation tags:

1. Open the AWS Billing and Cost Management console.
2. In the navigation pane, choose Cost allocation tags.
3. Filter by type IAM principal to find the tags you applied to your principals.
4. Select the tags and choose Activate.

Step 3: Create a CUR 2.0 data export with IAM-level data

To see identity-level cost breakdowns, create a CUR 2.0 data export that includes the caller identity:

1. Open the AWS Billing and Cost Management console.
2. In the navigation pane, choose Data Exports.
3. Choose Create
   
   
   

   If you need further guidance on AWS, our experts are available at AWS@westloop.io. You may also reach us by submitting the Contact Us form.