AWS publishes a five-stage playbook for managing Amazon Bedrock costs end to end

AWS ML Blog · rss · 2026-10-31

The AWS ML Blog published an end-to-end Amazon Bedrock cost management playbook for FinOps and platform engineering teams. Its core thesis: cost control is not about picking a cheaper model or shrinking prompts — it's an operating model.

Why agentic workloads cost more to manage

A conversational assistant issues one model invocation per user turn, while an agentic workflow (planning, reading files, calling tools, iterating) issues many invocations per task with larger contexts.
Token consumption therefore scales with the autonomy and context size of the workflow, not user interactions; published averages are a poor substitute for measuring your own workloads.

The five-stage loop

Attribute: every dollar lands on an identity, team, and application. Enable IAM principal data in CUR 2.0, tag IAM principals with team/application/cost center, activate them as cost allocation tags, and analyze in Cost Explorer within 24–48 hours.
Observe: log model invocations (request, response, metadata) to CloudWatch Logs and/or S3; use CloudWatch for fast operational queries and S3+Athena for long-term BI.
Enforce: budgets with teeth — alerts at minimum, hard blocks where risk demands.
Optimize: fix platform defaults centrally (model routing, caching, token limits) instead of asking every team to be careful.
Operate: a scorecard and review cadence turn data into decisions.

Key pitfall: the shared-role problem

An LLM gateway calling Bedrock through a single IAM role attributes every dollar to that one role, losing per-user visibility.
Fix: per-user session management — the gateway assumes the Bedrock invocation role once per user, passing the user as RoleSessionName and attributes as session tags, caching credentials up to 1 hour (one STS call per user per hour, not per request). The post includes a boto3 example, restoring per-user/per-tenant attribution behind a shared gateway.

Choosing an attribution mechanism: IAM principal + session tags recommended for bedrock-runtime (scales with your identity system, no pre-created resources); application inference profiles suit a small, stable set of apps needing invoice-grade billing separation; Projects are the path for OpenAI-compatible workloads on the bedrock-mantle endpoint (Responses / Chat Completions APIs).

Stages are deliberately sequenced — teams that jump straight to optimization without attribution and observability are guessing.

Original post →

AWS publishes a five-stage playbook for managing Amazon Bedrock costs end to end

More from coding & agent