Valistry

AWS Bedrock

CloudWatch's Bedrock token metrics per model per day and the Cost Explorer bill for the Bedrock service. Never invocation content, never other services.

Access

Kind
A read-only key you paste
What to give
Read-only IAM access keys
Why that one
An IAM user with cloudwatch:ListMetrics, cloudwatch:GetMetricData and ce:GetCostAndUsage (policy: docs/aws-readonly-policy.json). Keys are tested, then stored encrypted for this organization. A cross-account role with an external ID replaces keys once Valistry has its own AWS account.

What it attributes on its own

From the source
model · region · day
Needs a rule or a trace
inference profile and IAM principal — need invocation logs · workflow · agent · outcome

The addresses it calls

  • https://monitoring.<region>.amazonaws.com/ (CloudWatch ListMetrics, GetMetricData)
  • https://ce.us-east-1.amazonaws.com/ (Cost Explorer GetCostAndUsage)

Only these. A call anywhere else is refused before it leaves, and every call is logged.

Connecting it

  1. Create a read-only IAM user. Click Create user and fill the form: Open ↗
  2. Give it only the read policy. Open the user, then Permissions → Add permissions → Create inline policy: Open ↗
  3. Create an access key. Open the user, then Security credentials → Create access key: Open ↗
  4. Paste both values, choose the region, click Test and connect. Valistry reads seven days of CloudWatch metrics and the Cost Explorer bill, reports what each returned, and stores the keys only if the read succeeded.

Once Valistry runs in its own AWS account, this becomes a one-click cross-account role with an external ID and no keys at all.