IAM principal attribution

Amazon Bedrock automatically captures the IAM principal identity (IAM users and IAM roles) for every inference request. You can optionally attach tags to your principals for additional cost dimensions like team, department, or cost center. This gives you per-user and per-role cost visibility without code changes or additional resources.

IAM principal attribution currently works with Amazon Bedrock bedrock-runtime APIs (InvokeModel API / Converse API / Chat Completions API). Support for bedrock-mantle APIs is coming soon.

How it works

When an IAM user or role makes an inference request, Amazon Bedrock records the caller's identity. This information flows into AWS Cost Explorer and AWS Cost and Usage Reports (CUR 2.0), where you can filter and group costs by identity. No changes to your Amazon Bedrock API calls are required. Attribution is based on who made the call, not on API parameters.

Optionally, you can attach tags to your IAM principals to add organizational dimensions (team, department, cost center) to your billing data. Tags are not required for identity-level attribution. The caller identity is always captured.

Principal types

Amazon Bedrock captures identity from any IAM principal type. The two most common are IAM users and IAM roles.

IAM users call Amazon Bedrock directly using long-lived access keys. The IAM user name and any tags attached to the user are recorded in AWS Billing.

IAM roles are assumed by users, applications, or federated identities via AWS STS. When a principal calls sts:AssumeRole, the resulting temporary credentials carry the role's identity. Tags can come from two sources:

Most organizations use roles rather than IAM users for Amazon Bedrock access. If multiple users share the same role, session tags are how you distinguish them in billing.

Setting up IAM principal attribution

Identity-level attribution (the caller's IAM user or role ARN) is captured automatically for every Amazon Bedrock request. To add organizational dimensions like team or cost center to your billing data, follow these steps to tag your principals and activate the tags in AWS Billing.

Step 1: Apply tags to your IAM principals (optional)

Tags flow to your billing data in two ways:

Principal tags are attached directly to IAM users or roles. Set them once and they apply to every request from that principal. This is ideal for tagging individual developers (IAM users) or applications (IAM roles). You can apply principal tags using the IAM console, the AWS CLI (aws iam tag-role, aws iam tag-user), or the IAM API (TagRole, TagUser).

To learn more about IAM tagging and best practices, see Tags for IAM resources.

Session tags are passed dynamically when assuming an IAM role via AWS STS. They are ideal for federated users (authenticating through an identity provider like Okta, Auth0, or Entra) and LLM gateways that proxy requests on behalf of multiple users or tenants. Session tags can be passed in three ways:

The IAM role's trust policy must allow sts:TagSession for session tags to flow through. To learn more, see Pass session tags in AWS STS.

Both principal tags and session tags appear in CUR 2.0 with the iamPrincipal/ prefix.

Step 2: Activate cost allocation tags

To make your IAM principal tags appear in AWS Cost Explorer and CUR 2.0, you must activate them as cost allocation tags:

Step 3: Create a CUR 2.0 data export with IAM-level data

To see identity-level cost breakdowns, create a CUR 2.0 data export that includes the caller identity:

For more information, see Creating reports in the AWS Cost and Usage Reports User Guide.

Tagging dimensions

You can use any tag key that represents your organizational structure. Common dimensions include:

You can apply up to 50 principal or session tags per IAM user or role.

Federated access and session tags

For organizations using federated identity providers (AWS IAM Identity Center, Okta, Entra, Ping), session tags let you pass user attributes from your IdP to AWS. When a federated user assumes a role through AWS STS, the IdP can pass attributes like user email, team, and cost center as session tags. These tags are captured alongside the Amazon Bedrock request and flow to AWS CUR 2.0 and AWS Cost Explorer.

To set this up:

For more information, see Passing session tags in AWS STS.

Invocation patterns

IAM principal attribution works regardless of how your application calls Amazon Bedrock:

If you use an LLM gateway or API gateway and do not see user-level identity in AWS Billing, confirm that the gateway is passing session tags with each request.

Viewing costs

After activating your cost allocation tags, you can analyze Amazon Bedrock costs by principal in the following tools:

Cost data can take up to 24 hours to appear in AWS Cost Explorer and CUR 2.0 after a request is made.

Using IAM principal attribution with other methods

IAM principal attribution can be used alongside Projects and application inference profiles. This gives you multi-dimensional cost visibility.

We recommend using Projects for application-level attribution and IAM principal attribution for user-level attribution within the same account.