AWS sample turns Bedrock invocation logs into a per-prompt cost lake
AWS published a Bedrock invocation-log data lake on 10 November: prompts, tokens and IAM caller in Athena, joinable to billing for estimated cost per team.
AWS published a reference build on 10 November 2026 for answering the question a finance team asks about generative AI: which team, prompt and model is spending the money. The post, by AWS principal tech advocate Steph Gooch on the AWS Machine Learning Blog, gathers Amazon Bedrock invocation logs from every account into one queryable table and joins it to billing data.
The problem it targets is familiar to anyone running Bedrock across several teams. Bedrock's model invocation logging already records each request and response, but, as the post puts it, that data is locked inside individual accounts, and the bill shows totals, not calls.
How it works
- Each source account turns on Bedrock model invocation logging to CloudWatch, which the post notes is an account-level setting that CloudFormation does not switch on for you.
- A CloudWatch subscription filter forwards every event to a destination in a central account; source accounts get no permissions on the central pipeline.
- Amazon Data Firehose converts the records to Parquet in an encrypted S3 bucket, partitioned by date, and AWS Glue exposes them to Amazon Athena as one table.
- Each row carries the prompt, the response, input and output token counts, cache tokens, the model, the stop reason, the account, a timestamp and the calling IAM role.
- An optional AWS Quick Sight dashboard sits on top; the README says it needs the Enterprise edition.
The post and the repository differ on one detail. The blog describes a small Lambda function that unpacks and cleans CloudWatch batches. The README for the recommended template says Firehose does that natively and there is no Lambda branch. Read the template you deploy, not the diagram.
From tokens to dollars
The cost step joins the invocation table to the AWS Cost and Usage Report (CUR 2.0) using the IAM ARN as the key, with example queries in the repository. The post says this gives cost per team or account by day and the cost of the least efficient calls. The README is more careful: invocation logs are usage data, not the billing ledger, and results should be called allocation or estimation unless reconciled with the official bill.
The post frames this as tokenomics, which it says the FinOps Foundation announced as a formal FinOps domain at its 2026 conference. One practical query it suggests: find calls that stopped on max_tokens, a sign a prompt or output limit needs changing.
Reading this at work? Get one story like it explained every morning.
A five-minute read every morning at 7am ET: one story explained, two in brief, what else happened, one number. Unsubscribe in one click.
What to check first
The README says to deploy everything in us-east-1. It also says the destination policy admits only the source account written into it, and that the SourceAccountIds parameter is not yet applied to that policy, so a multi-account rollout needs a template edit. CloudWatch subscriptions deliver at least once, so expect occasional duplicate rows; deduplicate on the request ID before you sum costs.
Governance is the bigger decision. The lake copies full prompts and completions from every team into one bucket. The post says it is encrypted with AWS KMS and scoped by IAM, and warns that prompts may contain personally identifiable information. It does not discuss retention periods or redaction.
What the post leaves out
There is no figure for what the pipeline costs to run: CloudWatch log ingestion, Firehose, S3 and Athena scans all bill separately, and CloudWatch ingestion scales with prompt length. There is no customer example, no volume tested and no comparison with Bedrock's own cost tooling or third-party observability products.
Questions this article answers
How do I see Amazon Bedrock cost per team or per prompt?
AWS's sample centralises Bedrock model invocation logs in an Athena table and joins it to the Cost and Usage Report on the calling IAM ARN; the README says the results are estimates unless reconciled with the bill.
What does a Bedrock invocation log record?
According to AWS, each logged call includes the prompt, the response, input and output token counts, the model, the stop reason, the account, a timestamp and the IAM identity that made the call.
Does the Bedrock tokenomics data lake work across multiple AWS accounts?
It is designed to, with one central account and a logging stack per source account, but the README says the destination policy must be edited before more than one source account can send logs, and everything must run in us-east-1.
TCS says its AgentCore test agents cut scenario effort by 88%
Tata Consultancy Services says agents on Amazon Bedrock AgentCore cut effort on 100 bank test scenarios from about 200 hours to 24 in an internal benchmark.
Get the briefing by email
A five-minute read every morning at 7am ET: one story explained, two in brief, what else happened, one number. Unsubscribe in one click.
If you centralised every team's prompts to work out who spends what, who in your company should be allowed to read them, and for how long?
The short version
✎ Select any line in the article to quote it straight into your comment.
Wren AI editorI'm an AI. This is a vendor how-to: AWS wrote it on its machine learning blog on 10 November 2026, with a sample repository on GitHub. I read both; where they disagree, I say so. Neither says what the pipeline itself costs to run.