Valistry

AWS Bedrock

Bedrock cost by model, day and caller. Tokens, cache, calls, errors and latency. With the export, each caller's bill. Also calls refused at a rate limit, images and Guardrails safety checks. Whether Bedrock logs calls, as on or off. Never prompts, replies or logs. AWS lets the read see your whole bill; Valistry keeps only Bedrock.

Access

Kind
Sign in on the vendor's page; nothing typed here
What to give
Read-only IAM access keys
Why that one
An IAM user with cloudwatch:ListMetrics, cloudwatch:GetMetricData, ce:GetCostAndUsage, ce:GetTags, bedrock:GetInferenceProfile, bedrock:ListTagsForResource and bedrock:GetModelInvocationLoggingConfiguration. Keys are tested, then stored encrypted for this organization.

What it attributes on its own

From the source
model; region; day; each caller's bill per model and day, with the Cost and Usage Report export
Needs a rule or a trace
the person behind a shared role's session, until a rule names them; workflow; agent; outcome

The addresses it calls

  • https://monitoring.<region>.amazonaws.com/ (CloudWatch ListMetrics, GetMetricData)
  • https://ce.us-east-1.amazonaws.com/ (Cost Explorer GetCostAndUsage)
  • https://sts.us-east-1.amazonaws.com/ (STS AssumeRole for a connected role; GetCallerIdentity, which needs no permission, to name the account a key reads)
  • https://<your export bucket>.s3.<its region>.amazonaws.com/ (S3 ListObjectsV2 and GetObject, under your export's path only, where you set one)

Valistry calls only these addresses. It blocks any other call and logs every call.

Connecting it

  1. Create the user. Sign in to your Bedrock account. Search IAM → Users → Create user. Open ↗
  2. Add the read policy. In IAM → Users, click valistry-read. Open ↗
  3. Create an access key. Search IAM → Users. AWS shows the secret once: copy both. Open ↗
  4. Per-person export (optional). Create export → Standard data export (CUR 2.0). Then add the policy below. Open ↗

Tokens are read in the account that runs Bedrock. Its bill shows there, or in the management account that pays for it. If the bill shows $0.00 here, the sync says so.

Settings worth turning on in AWS

  1. Tag each app. Give each app its own tag, then turn the tags on in Billing. Valistry reads it.
  2. Name the caller on the bill. Create a new cost report export with caller names on.
  3. Keep prompts out of the logs. If you turn on invocation logs, leave text and images out.
  4. Split AgentCore telemetry. Tag each agent, and keep token counts apart from prompt text.
  5. Turn on the Kiro user report. An admin turns it on. Kiro then writes daily files to your S3 bucket: credits and messages per model, for each user.
  6. Turn on Cost Anomaly Detection. Since August 19, 2026 it covers third-party models on Bedrock, such as Claude, and tells you when spend jumps.

Questions about Amazon Bedrock

What access does Valistry need?A read-only role in your AWS account. It reads CloudWatch metrics, the bill, your AWS budgets, and whether Bedrock call logging is on. Nothing else, and never a prompt or a log.
Do we need tags first?No. Valistry reads what you have and shows how much your tags cover. Rules give owners to the rest.
We use AWS Organizations. Where does the role go?In the payer account for the bill, and in each account that calls Bedrock.