Amazon Bedrock guide.
What Valistry reads from Bedrock, what to know before you connect, and the AWS settings that make Bedrock cost easier to read.
What it reads
- Usage
- Tokens and images per model per day, Projects on the OpenAI-compatible endpoint, and Bedrock Guardrails text units, from CloudWatch.
- The bill
- Bedrock's charges by usage type, and which tags cover them, from Cost Explorer. Models sold through AWS Marketplace included.
- Access
- A read-only role from our template, with eight actions: cloudwatch:ListMetrics, cloudwatch:GetMetricData, ce:GetCostAndUsage, ce:GetTags, bedrock:GetInferenceProfile, bedrock:ListTagsForResource, bedrock:GetModelInvocationLoggingConfiguration (whether call logging is on, never the logs) and budgets:ViewBudget. If you export Bedrock per person, two more on that export's path only: s3:ListBucket and s3:GetObject. Nothing else.
- Never
- No prompt, no response, no log. The role cannot read them.
Before you connect
- AWS Organizations
- The bill is in the payer account. Create the role there, and in each account that calls Bedrock.
- A shared gateway role
- Behind one role, such as a LiteLLM proxy, every call has the same caller. Tags or the gateway's own records split it.
- Tags
- Activate them in Billing first. Cost Explorer groups by a tag only from that day.
The connector page has the steps and the exact addresses it calls.
AWS settings worth turning on
Most useful first. Each makes your Bedrock bill easier to read, with or without Valistry.
- Tag each app (Valistry reads it)
- Give each app its own application inference profile, or its own Project on the bedrock-mantle endpoint. Then activate the tags in Billing. The paying account can backfill them up to 12 months.
- Name the caller on the bill
- Since April 9, 2026 the bill can name the IAM caller. Create a new CUR 2.0 export with caller identity on. An existing export does not gain it.
- Keep prompts out of the logs
- Invocation logs are off by default. If you turn them on, switch off text and image content. To tag calls by team, try request metadata in a test account first.
- Split AgentCore telemetry
- Tag each agent. Choose split telemetry, so token counts sit apart from prompt text. Agents created since July 20, 2026 keep them together by default.
- Turn on the Kiro user report
- An admin turns it on. Kiro then writes daily files to your S3 bucket: credits and messages per model, for each user.
- Turn on Cost Anomaly Detection
- Since August 19, 2026 it covers third-party models on Bedrock, such as Claude, and tells you when spend jumps.
Image models, by price
Per image in us-east-1, as AWS lists it on 29 September 2026. You decide which model is good enough. When image spend jumps, the alert names the cheaper models.
- Amazon Titan Image Generator v2
- $0.008 to $0.012
- Stable Image Core
- $0.04
- Amazon Nova Canvas
- $0.04 to $0.08
- Stable Diffusion 3.5 Large
- $0.08
- Stable Image Ultra
- $0.14
Text models: four more changes, with a gateway
These need one row per call. Bedrock's metrics give a total per model per day, so connect the gateway or telemetry your calls pass through.
- Prompt caching
- A cached read costs a fraction of a fresh input token. We price the context you send again and again.
- The right model for the job
- Simple calls on an expensive model. We show what they would cost on a cheaper one.
- Work that can wait
- Batch costs less than on-demand. We find the calls nobody waits for.
- Retries
- Third and later tries on the same run, counted and priced. You can set a retry limit.