Skip to content

AWS 2026-08-13

Read original ↗

Track generative AI costs with Amazon Bedrock inference profiles

Summary

AWS describes a cost-attribution architecture for a shared Amazon Bedrock application that invokes one foundation model under one IAM role on behalf of several departments. Rather than expose an IAM identity per user or team, the application derives a trusted department attribute at its authentication layer and routes each request to a department-specific application inference profile. Each profile is a tagged wrapper around the same model; once the Team cost-allocation tag is activated, Cost Explorer can group Bedrock spend by department. The invocation API and per-token rate are unchanged; the selected modelId is the profile ARN rather than the raw model ID. (Source: sources/2026-08-13-aws-track-generative-ai-costs-with-amazon-bedrock-inference-profiles)

Key takeaways

  1. The attribution boundary need not equal the invocation identity. A shared application role cannot distinguish HR, Accounting, and IT in billing data. The architecture preserves the shared role but carries the department boundary in the selected inference-profile resource. (Source: sources/2026-08-13-aws-track-generative-ai-costs-with-amazon-bedrock-inference-profiles)
  2. Profiles are tagged indirection, not model copies. Each application inference profile points to the same foundation model and has a distinct Team tag such as Team=HR; profile choice changes accounting metadata, not the model serving rate. (Source: sources/2026-08-13-aws-track-generative-ai-costs-with-amazon-bedrock-inference-profiles)
  3. The application owns classification and routing. It authenticates the user, obtains department from a trusted OIDC/SAML claim, user-record lookup, or session attribute, validates the value against an allowlist, then passes the corresponding profile ARN as modelId. (Source: sources/2026-08-13-aws-track-generative-ai-costs-with-amazon-bedrock-inference-profiles)
  4. Billing tag activation is a delayed control-plane step. Resource tags do not immediately become a Cost Explorer dimension: the payer account must activate Team, and the article says attributed costs can take 24–48 hours to appear. Tag keys are case-sensitive. (Source: sources/2026-08-13-aws-track-generative-ai-costs-with-amazon-bedrock-inference-profiles)
  5. Multi-account reporting centralizes at the payer. In an AWS Organizations topology, activation in the management account enables tagged usage from member accounts to consolidate into Cost Explorer. (Source: sources/2026-08-13-aws-track-generative-ai-costs-with-amazon-bedrock-inference-profiles)
  6. Authorization covers both layers of indirection. An invocation through a profile requires IAM permission on both the application-profile ARN and the underlying foundation-model ARN. A wildcard simplifies onboarding new departments; specific profile ARNs minimize the application role's authority. (Source: sources/2026-08-13-aws-track-generative-ai-costs-with-amazon-bedrock-inference-profiles)
  7. The pattern is operationally cheap but lifecycle-sensitive. Profiles incur no charge themselves and do not alter per-token model pricing, but deleting one immediately breaks clients using its ARN; recreating it produces a new ARN and requires an application-map update. (Source: sources/2026-08-13-aws-track-generative-ai-costs-with-amazon-bedrock-inference-profiles)
  8. One profile can cover higher-level Bedrock features. The same tagged profile ARN can be supplied to Knowledge Bases, extending a team boundary beyond a direct model invocation. (Source: sources/2026-08-13-aws-track-generative-ai-costs-with-amazon-bedrock-inference-profiles)

Architecture

user authentication
        │ trusted department claim / lookup
        ▼
application routing map: department → profile ARN
        │
        ├── HR         → profile HR         (Team=HR)         ┐
        ├── Accounting → profile Accounting (Team=Accounting) │ same foundation model
        └── IT         → profile IT         (Team=IT)         ┘
                                      │
                                      ▼
                            Amazon Bedrock invocation
                            (one shared IAM role)
                                      │
                                      ▼
                        tagged billing records → Cost Explorer
                                      │
                                      ▼
                             group by `Team` per period

The model call remains converse(modelId=profile_arn, ...); only the resource identifier changes. The application must reject an unknown department rather than fall through to an untagged model identifier. (Source: sources/2026-08-13-aws-track-generative-ai-costs-with-amazon-bedrock-inference-profiles)

Operational evidence and constraints

Item Article disclosure Design consequence
Profile-to-model mapping Many department profiles may point to one foundation model Attribution does not require model duplication or per-department runtime identity
Cost allocation tag Example: Team=HR The tag becomes the reporting dimension only after payer-account activation
Reporting latency 24–48 hours after activation Not suitable as a real-time budget-enforcement signal without a supplementary telemetry path
Invocation cost Same per-token price with or without profile The profile is attribution metadata, not a discounted SKU
IAM scope Profile ARN plus foundation-model ARN Indirection adds an authorization dependency
Provisioning scale CloudFormation AWS::Bedrock::ApplicationInferenceProfile Prefer infrastructure-as-code when profile cardinality reaches dozens of teams
Profile deletion Immediate impact; replacement gets a new ARN Treat profile ARN changes as an application configuration rollout
Example setup estimate 30 minutes, plus reporting delay Tutorial estimate, not a production migration estimate

Systems, concepts, and patterns extracted

Caveats

  • This is a reference architecture and console/API walkthrough, not a production retrospective; it reports no request volume, token mix, cost amounts, or attribution-accuracy measurement.
  • The source assumes the application can determine department from a trusted source. It does not define claim issuance, authorization policy, stale-claim handling, or how users with multiple valid cost centers choose one.
  • Team supports chargeback visibility but does not by itself enforce a budget, quota, rate limit, model allowlist, or tenant data boundary. AWS Budgets and Cost Anomaly Detection are named as follow-on tools, not integrated control loops.
  • Cost Explorer's 24–48-hour delay makes it unsuitable for immediate runaway-token detection; application telemetry remains necessary for near-real-time monitoring.
  • A profile tag attributes the selected resource, not necessarily the business value of a request. Shared workflows, retries, background jobs, and cross-department sessions need an explicit ownership rule.
  • The wildcard profile IAM example reduces onboarding friction but lets the role invoke every matching application profile; use explicit ARNs when the role should have a fixed department set.
  • Region/model availability, profile limits, tag policies, CloudFormation rollout behavior, and retention or export characteristics of Cost Explorer are outside the article.

Source

Last updated · 622 distilled / 1,953 read