AWS bedrock documentation change
Summary
Restructured cost attribution documentation with improved goal-based guidance, added LLM gateway attribution section, and revised comparison tables.
Security assessment
Changes focus entirely on cost management mechanisms and attribution methods. No security vulnerabilities, patches, or security features are mentioned. The IAM principal attribution references are for cost tracking purposes only, not security enforcement.
Diff
diff --git a/bedrock/latest/userguide/cost-management.md b/bedrock/latest/userguide/cost-management.md index de1713212..55ee0e228 100644 --- a//bedrock/latest/userguide/cost-management.md +++ b//bedrock/latest/userguide/cost-management.md @@ -7 +7 @@ -Choosing an approach +Choosing an approachAttribution behind an LLM gateway @@ -13 +13,3 @@ Amazon Bedrock provides multiple ways to attribute model inference usage and cos -## Choosing an approach +###### Tip + +If you're not sure which mechanism fits your use case, start with the [Frequently asked questions](./cost-mgmt-faq.html) at the end of this chapter. It answers common decision questions like "I want per-user, per-prompt attribution — what are my choices?" and "What's the difference between classic CUR and CUR 2.0?". @@ -15 +17 @@ Amazon Bedrock provides multiple ways to attribute model inference usage and cos -The cost attribution method you choose depends on which dimension you want to track, which Amazon Bedrock APIs you use, and what level of granularity you need. The following tables present three views of the same set of mechanisms. Use the first table to look up mechanisms by the dimension you want to attribute by, the second to look up mechanisms by the API you call, and the third to compare mechanisms side by side. +## Choosing an approach @@ -17,7 +19 @@ The cost attribution method you choose depends on which dimension you want to tr -I want to attribute costs by... | Use... | Where to view costs | Supported APIs | `bedrock-runtime` | `bedrock-mantle` ----|---|---|---|---|--- -Identity (IAM users, IAM roles, and federation) | [IAM principal attribution](./cost-mgmt-iam-principal-tracking.html) | AWS Cost Explorer / CUR 2.0 | [InvokeModel](./inference-api.html) / [Converse](./conversation-inference.html) / [Chat Completions](./inference-chat-completions-mantle.html) |  |  -Application or team with tags | [Projects](./cost-mgmt-projects.html) (Recommended) | AWS Cost Explorer / CUR 2.0 | [Responses](./bedrock-mantle.html) / [Chat Completions](./inference-chat-completions-mantle.html) |  |  -Application or team with tags | [Application inference profiles](./cost-mgmt-application-inference-profiles.html) | AWS Cost Explorer / CUR 2.0 | [InvokeModel](./inference-api.html) / [Converse](./conversation-inference.html) / [Chat Completions](./inference-chat-completions-mantle.html) |  |  -Application or team with tags | [Workspaces](./cost-mgmt-workspaces.html) (Recommended) | AWS Cost Explorer / CUR 2.0 | [Anthropic Messages](./inference-messages-api.html) |  |  -Custom tag (per-request) | [Per-request metadata tagging](./cost-mgmt-request-metadata.html) | Invocation logs only | [InvokeModel](./inference-api.html) / [InvokeModelWithResponseStream](./inference-api.html) / [Converse](./conversation-inference.html) / [ConverseStream](./conversation-inference.html) |  |  +The cost attribution method you choose depends on which dimension you want to track, which Amazon Bedrock APIs you use, and what level of granularity you need. The following two tables present complementary views. Use the first to look up mechanisms by your goal, and the second to compare mechanisms side by side. @@ -25 +21 @@ Custom tag (per-request) | [Per-request metadata tagging](./cost-mgmt-request-me -###### Mechanisms by API +###### Choose by goal @@ -27 +23 @@ Custom tag (per-request) | [Per-request metadata tagging](./cost-mgmt-request-me -The following table lists the usage tracking mechanisms available for each Amazon Bedrock inference API. +If you know what you want out of cost tracking, start here. @@ -29,8 +25,7 @@ The following table lists the usage tracking mechanisms available for each Amazo -If you call this API | On this endpoint | You can use these mechanisms ----|---|--- -[InvokeModel](./inference-api.html), [InvokeModelWithResponseStream](./inference-api.html) | [bedrock-runtime](./endpoints.html) | [IAM principal attribution](./cost-mgmt-iam-principal-tracking.html), [Application inference profiles](./cost-mgmt-application-inference-profiles.html), [Per-request metadata tagging](./cost-mgmt-request-metadata.html) -[Converse](./conversation-inference.html), [ConverseStream](./conversation-inference.html) | [bedrock-runtime](./endpoints.html) | [IAM principal attribution](./cost-mgmt-iam-principal-tracking.html), [Application inference profiles](./cost-mgmt-application-inference-profiles.html), [Per-request metadata tagging](./cost-mgmt-request-metadata.html) -[Chat Completions](./inference-chat-completions-mantle.html) | [bedrock-runtime](./endpoints.html) | [IAM principal attribution](./cost-mgmt-iam-principal-tracking.html), [Application inference profiles](./cost-mgmt-application-inference-profiles.html) -[Responses](./bedrock-mantle.html) | [bedrock-mantle](./endpoints.html) | [Projects](./cost-mgmt-projects.html) -[Chat Completions](./inference-chat-completions-mantle.html) | [bedrock-mantle](./endpoints.html) | [Projects](./cost-mgmt-projects.html) -[Anthropic Messages](./inference-messages-api.html) | [bedrock-mantle](./endpoints.html) | [Workspaces](./cost-mgmt-workspaces.html) +If your goal is… | Use +---|--- +Per-user or per-team dollars on your bill | [IAM principal attribution](./cost-mgmt-iam-principal-tracking.html) +Per-application or per-workload dollars | [Application inference profiles](./cost-mgmt-application-inference-profiles.html) (`bedrock-runtime`), or [Projects](./cost-mgmt-projects.html) and [Workspaces](./cost-mgmt-workspaces.html) (`bedrock-mantle`) +Per-prompt token usage and cost, sliced by any dimension | [Per-request metadata tagging](./cost-mgmt-request-metadata.html), with [model invocation logs](./model-invocation-logging.html) +Per-user and per-prompt detail | [Model invocation logs](./model-invocation-logging.html), with the user taken from the `identity` ARN or a [request-metadata](./cost-mgmt-request-metadata.html) tag +Both invoice-accurate dollars and per-prompt detail | Combine a native method (for example, [IAM principal attribution](./cost-mgmt-iam-principal-tracking.html)) with [Per-request metadata tagging](./cost-mgmt-request-metadata.html) @@ -40 +35,23 @@ If you call this API | On this endpoint | You can use these mechanisms -The following table compares the available mechanisms by what they let you attribute by, where the data is delivered, and which APIs they support. +The following table compares the available mechanisms by what they let you attribute by, what they output, the granularity of that output, where the data is delivered, and which endpoints they support. + +Mechanism | Attribute by | Output | Granularity | Data destination | Supported APIs | `bedrock-runtime` | `bedrock-mantle` +---|---|---|---|---|---|---|--- +[IAM principal attribution](./cost-mgmt-iam-principal-tracking.html) | IAM identity | Billed dollars | Aggregated, per usage type per day | AWS Cost Explorer / CUR 2.0 | InvokeModel, Converse, Chat Completions |  |  +[Application inference profiles](./cost-mgmt-application-inference-profiles.html) | Profile resource tags | Billed dollars | Aggregated, per usage type per day | AWS Cost Explorer / CUR 2.0 | InvokeModel, Converse, Chat Completions |  |  +[Projects](./cost-mgmt-projects.html) | Project resource tags | Billed dollars | Aggregated, per usage type per day | AWS Cost Explorer / CUR 2.0 | Responses, Chat Completions |  |  +[Workspaces](./cost-mgmt-workspaces.html) | Project resource tags via workspace header | Billed dollars | Aggregated, per usage type per day | AWS Cost Explorer / CUR 2.0 | Anthropic Messages |  |  +[Per-request metadata tagging](./cost-mgmt-request-metadata.html) | Per-request key-value tags | Token counts (you convert to cost) | Per request | Invocation logs only | InvokeModel, InvokeModelWithResponseStream, Converse, ConverseStream |  |  + +###### Note + +The native methods ([IAM principal attribution](./cost-mgmt-iam-principal-tracking.html), [Application inference profiles](./cost-mgmt-application-inference-profiles.html), [Projects](./cost-mgmt-projects.html), and [Workspaces](./cost-mgmt-workspaces.html)) deliver aggregated billed dollars to AWS Cost Explorer and CUR 2.0. The finest grain is per usage type per day, attributed by identity or tag; they do not produce a per-request row. For per-prompt detail, use [model invocation logs](./model-invocation-logging.html), where each call is a separate record carrying its own token counts. + +## Attribution behind an LLM gateway + +When a gateway or proxy calls Amazon Bedrock on behalf of many users, Amazon Bedrock records the gateway's IAM role as the caller's identity. To preserve user-level attribution, choose based on the output you need. + + * For per-user dollars in your billing tools, have the gateway assume its Amazon Bedrock role per user or tenant, using a per-user `RoleSessionName` or session tags. Cache the resulting credentials for the session lifetime to avoid an AWS STS call on every request. For more information, see [IAM principal attribution](./cost-mgmt-iam-principal-tracking.html). + + * For per-prompt detail, set the user in [request metadata](./cost-mgmt-request-metadata.html) on each call. Request metadata varies per request without additional AWS STS calls, which session tags cannot do on a shared session. + + @@ -42,7 +58,0 @@ The following table compares the available mechanisms by what they let you attri -Mechanism | Attribute by | Data destination | Supported APIs ----|---|---|--- -[IAM principal attribution](./cost-mgmt-iam-principal-tracking.html) | IAM identity | AWS Cost Explorer / CUR 2.0 | InvokeModel, Converse, Chat Completions (all on [bedrock-runtime](./endpoints.html)) -[Application inference profiles](./cost-mgmt-application-inference-profiles.html) | Profile resource tags | AWS Cost Explorer / CUR 2.0 | InvokeModel, Converse, Chat Completions (all on [bedrock-runtime](./endpoints.html)) -[Projects](./cost-mgmt-projects.html) | Project resource tags | AWS Cost Explorer / CUR 2.0 | Responses, Chat Completions (all on [bedrock-mantle](./endpoints.html)) -[Workspaces](./cost-mgmt-workspaces.html) | Project resource tags via workspace header | AWS Cost Explorer / CUR 2.0 | Anthropic Messages ([bedrock-mantle](./endpoints.html) only) -[Per-request metadata tagging](./cost-mgmt-request-metadata.html) | Per-request key-value tags | Invocation logs only | InvokeModel, InvokeModelWithResponseStream, Converse, ConverseStream (all on [bedrock-runtime](./endpoints.html))