Amazon Web Services announced granular cost attribution for Amazon Bedrock inference, a feature AWS says automatically assigns inference costs to the IAM principal that made each API call. The change is described in a post on the AWS Machine Learning Blog dated April 17, 2026.
According to AWS, attribution flows into AWS Billing across models with "no resources to manage and no changes to your existing workflows." Source: https://aws.amazon.com/blogs/machine-learning/introducing-granular-cost-attribution-for-amazon-bedrock/
What AWS Says the Feature Does
AWS states that Amazon Bedrock now captures the IAM principal — an IAM user, an assumed role, or a federated identity from a provider such as Okta or Entra ID — behind each inference call and writes that identity to the line_item_iam_principal column of Cost and Usage Reports 2.0 (CUR 2.0).
In a sample table included in the post, AWS shows a user named Alice incurring $0.069 on Claude 4.6 Sonnet input tokens and $0.214 on output tokens, alongside a user named Bob incurring $0.198 on Claude 4.6 Opus input tokens and $0.990 on output tokens. The company states that the line_item_usage_type field encodes region, model, and token direction.
AWS says the feature works for direct IAM users, Amazon Bedrock API keys that map to IAM users, IAM roles assumed by applications such as AWS Lambda functions, and federated users whose session names appear in the principal ARN.
Tagging for Team and Project Rollups
AWS describes two tag mechanisms for aggregating spend beyond the individual principal. Principal tags are attached directly to IAM users or roles, while session tags are passed at the time a role is assumed or embedded in identity provider assertions, according to the post.
After activation as cost allocation tags in AWS Billing, both tag types appear in the tags column of CUR 2.0 with the
iamPrincipal/prefix.
The company states that once tags are activated in the AWS Billing console or through the UpdateCostAllocationTagsStatus API, they surface in Cost Explorer and CUR 2.0 within 24 to 48 hours. For further guidance, the post links to the AWS whitepaper "Best Practices for Tagging AWS Resources," which includes a section on building a cost allocation strategy.
Four Access Patterns, Four Setups
AWS outlines four scenarios in the announcement. For developers using IAM users or Amazon Bedrock API keys, the company says each user's ARN appears directly in CUR 2.0, and tags only need to be added if customers want custom rollups by team or cost center.
For applications using IAM roles, AWS says each role's ARN appears in the report. For users authenticating through an identity provider, the session name in the assumed-role ARN identifies the individual, and session tags can be passed from the IdP.
LLM Gateway Setups Require Extra Work
AWS flags one configuration that does not get per-user attribution out of the box. According to the post, when customers route Amazon Bedrock traffic through an LLM gateway, CUR 2.0 "only shows gateway's role (one identity for all users)."
To recover user-level attribution in that setup, AWS says customers must implement "per-user AssumeRole with session name and tags" — meaning the gateway has to assume a distinct role per end user and pass session tags on each call. Without that change, the company states, "traffic is attributed to the gateway's single role."
Example Output in CUR 2.0
In a sample CUR 2.0 excerpt for a two-person data science team, AWS shows tagged line items such as {"iamPrincipal/team":"BedrockDataScience","iamPrincipal/cost-center":"12345"} attached to each user's Claude 4.6 Sonnet and Opus token charges. The company provides AWS CLI commands using aws iam tag-user to attach team and cost-center tags to individual IAM users.
AWS states that customers can filter on line_item_iam_principal to see individual spend, or on line_item_usage_type to break costs down by model and by input versus output tokens.
The blog post was authored by members of the AWS Machine Learning team and published on the AWS Machine Learning Blog.
