AWS bedrock documentation change
Summary
Added documentation for retrieving cost data from logs including code examples for CloudWatch/Athena queries and CUR reconciliation. Enhanced considerations section with metadata enforcement guidance.
Security assessment
Changes focus on cost management and usage attribution through request metadata. No security vulnerabilities are addressed. New content explains operational practices for cost allocation and logging, but doesn't introduce security features or mitigate security risks.
Diff
diff --git a/bedrock/latest/userguide/cost-mgmt-request-metadata.md b/bedrock/latest/userguide/cost-mgmt-request-metadata.md index cc3815a23..c392b7b7e 100644 --- a//bedrock/latest/userguide/cost-mgmt-request-metadata.md +++ b//bedrock/latest/userguide/cost-mgmt-request-metadata.md @@ -7 +7 @@ -How request metadata worksLimitsWhere request metadata appearsConsiderations +How request metadata worksLimitsWhere request metadata appearsGetting cost from your logsConsiderations @@ -72,0 +73,19 @@ When you sign requests with AWS Signature Version 4 (SigV4), include `X-Amzn-Bed +The following example sets request metadata with the AWS SDK for Python (Boto3) on a Converse call. The SDK includes the metadata in the SigV4-signed headers for you. + + + import boto3 + + client = boto3.client("bedrock-runtime") + + response = client.converse( + modelId="us.anthropic.claude-opus-4-8", # or an inference profile ARN + messages=[{"role": "user", "content": [{"text": "Summarize this ticket."}]}], + requestMetadata={ + "user": "[email protected]", + "team": "growth", + "feature": "summarizer", + "environment": "prod", + }, + ) + + @@ -114,0 +134,43 @@ You can filter and aggregate logs by metadata fields in Amazon CloudWatch Logs I +## Getting cost from your logs + +Request metadata and token counts are written to your model invocation logs, not to your bill. There are two ways to turn them into cost. + +Compute from token counts + + +Each log record carries the input, output, cache-read, and cache-write token counts for the request. Multiply these by the per-token rates in [Amazon Bedrock pricing](https://aws.amazon.com/bedrock/pricing/) and group by any metadata tag. This is per-prompt and near real-time, but it is an estimate. You maintain the rate card, and it does not reflect discounts, commitments, batch pricing, free tier, or provisioned throughput unless you model them. + +The following CloudWatch Logs Insights query totals tokens per user and model when invocation logs are delivered to CloudWatch Logs: + + + fields requestMetadata.user as user, modelId, + input.inputTokenCount as inTokens, + output.outputTokenCount as outTokens + | stats sum(inTokens) as totalInput, + sum(outTokens) as totalOutput, + count() as calls + by user, modelId + | sort totalInput desc + +For logs delivered to Amazon S3, the following Amazon Athena query estimates cost by team. Replace the per-token rates with the current rates from [Amazon Bedrock pricing](https://aws.amazon.com/bedrock/pricing/), and adjust the table and column references to match your AWS Glue table definition. + + + SELECT requestMetadata.team AS team, + modelId, + SUM(input.inputTokenCount) AS input_tokens, + SUM(output.outputTokenCount) AS output_tokens, + SUM(input.inputTokenCount) * 0.000015 AS est_input_cost, + SUM(output.outputTokenCount) * 0.000075 AS est_output_cost + FROM bedrock_invocation_logs + GROUP BY requestMetadata.team, modelId + ORDER BY est_input_cost DESC; + +Reconcile against CUR + + +Join your invocation logs to your AWS Cost and Usage Report for invoice-accurate totals. Neither classic CUR nor CUR 2.0 includes a per-request identifier on its line items; both aggregate cost by usage type over an hour or a day. Treat this path as reconciliation at the model and usage-type grain, with the logs providing the per-request detail underneath. + +###### Note + +Request metadata and IAM session tags are different mechanisms. Request metadata is set per call and varies per request; it lands in your invocation logs. IAM session tags are bound per session and surface only as aggregated billing data in AWS Cost Explorer and CUR. For per-user, per-prompt attribution, use request metadata, or a per-user identity in the ARN, rather than session tags. + @@ -124,0 +187,2 @@ You can filter and aggregate logs by metadata fields in Amazon CloudWatch Logs I + * Request metadata is supplied per call and is not enforced by Amazon Bedrock. Requests that omit it still succeed, and there is no service-side policy to require it. To guarantee coverage across an organization, set request metadata in a shared client or LLM gateway. For attribution that is always present without per-call code, use [IAM principal attribution](./cost-mgmt-iam-principal-tracking.html), which captures the caller identity automatically. +