Amazon describes a method for tracking and limiting Amazon Bedrock costs by IAM identity

Amazon has published a guide on the AWS Machine Learning Blog on how to track and limit Amazon Bedrock spending by individual IAM identities using only native AWS tools, without writing custom code. The solution is built on three steps: attribution, reporting, and enforcing limits.

Attribution happens automatically – Amazon Bedrock records the identity of the caller (IAM user or role) for every inference request, without requiring any changes to the model call. According to the company, if multiple people share a single role, more granular differentiation can be added using session tags passed when assuming the role; if each user or application has its own role, principal tags directly on the role are sufficient. The tags then need to be activated as cost allocation tags, and within an AWS Organization, activation is performed in the management (payer) account and does not apply retroactively.

Reporting is possible in two ways: without code via AWS Cost Explorer (filtered to Amazon Bedrock, grouped by tag), or via SQL queries through an AWS Cost and Usage Reports (CUR) 2.0 export using Amazon Athena, where principal and session tags appear as columns with the prefix iamPrincipal/. For enforcing limits, the company recommends creating an AWS Budget focused on Amazon Bedrock, filtered by specific identity or tag value, and attaching a budget action that automatically applies a Deny IAM policy once the threshold is exceeded.

According to Amazon, this is a simpler alternative to the previously described approach by Jamf, which required a custom cost-enforcement loop built on AWS IAM Identity Center, Amazon Athena over inference logs, and AWS Lambda – this provides near real-time control, but requires code that the company must operate and maintain itself. The source article is incomplete; details on the implementation steps and a sample query repository can be found in the source article.