← Agent Frameworks 🕐 19 min read
Agent Frameworks

Bedrock Flows, Prompt Management, Model Invocation Logging, and Marketplace Cost Tracking (2026)

Executive Summary · March 2026

Bedrock is no longer a single-product inference service.

Bedrock is no longer a single-product inference service. As of mid-2026, a production Bedrock stack typically touches six or more billing-distinct service lines: standard inference, Flows node transitions, Agents steps, Guardrails text units, Knowledge Bases storage and retrieval, and (if you have enabled it) Model Invocation Logging infrastructure. Most cost overruns happen not from token rates but from the secondary meters: an agent pipeline that multiplies tokens 5–10x per user turn, a Flows workflow that traverses 25 nodes per execution, CloudWatch Logs ingestion running at $0.50/GB, or an OpenSearch Serverless Knowledge Base with a $350/month floor regardless of usage. This note maps every major non-inference meter, how each one appears in CUR, and how to govern the total.

1. Bedrock Flows

What It Is

Bedrock Flows (GA November 2024) is a visual, low-code workflow builder for chaining Bedrock primitives — prompts, agents, knowledge bases, Guardrails, Lambda functions, and Amazon Lex — into multi-step pipelines. Flows is designed for teams that want orchestration without writing LangChain or LangGraph code. The canvas exposes a directed acyclic graph (DAG) model: nodes pass structured data between them via typed connectors. Each deployed flow gets an ARN and is invoked through InvokeFlow (synchronous) or StartFlowExecution (asynchronous/streaming, added 2025).

Node Types

A Flows DAG can include:

  • Input / Output nodes — entry and exit points; always present
  • Prompt nodes — call a foundation model; accept a Prompt Management ARN or inline prompt
  • Agent nodes — hand off to a Bedrock Agent for tool use and multi-step reasoning
  • Knowledge Base nodes — perform a retrieval query
  • Condition nodes — branch the graph based on output field values
  • Iterator / Collector nodes — fan-out and fan-in over arrays (added GA 2025)
  • Lambda nodes — call an arbitrary Lambda function
  • Lex nodes — integrate Amazon Lex conversation flows

Pricing

Primary meter: $0.035 per 1,000 node transitions, billed monthly, metered daily. Effective February 1, 2025.

A “node transition” is counted each time execution passes from one node to the next, including the initial input → first node move and each intermediate edge. The final node → output edge also counts.

Example: A summarization workflow: Input → Prompt node → Output = 2 transitions. A research workflow: Input → Knowledge Base → Prompt → Condition → (Branch A: Lambda → Prompt → Output) = 5 transitions on the main path.

Worked example from AWS docs: A news aggregation flow with 25 node transitions per execution, 960 executions per month:

25 × 960 = 24,000 transitions
24,000 ÷ 1,000 × $0.035 = $0.84/month in Flows meter

The $0.84 Flows charge is dwarfed by the model inference it invokes. At Claude Sonnet 4.6 rates ($3/$15 per million tokens in/out), 960 executions consuming 1,000 input tokens and 500 output tokens each would add:

Input:  960 × 1,000 ÷ 1,000,000 × $3.00  = $2.88
Output: 960 ×   500 ÷ 1,000,000 × $15.00 = $7.20
Total inference: $10.08
Total with Flows meter: $10.92/month

The Flows meter is ~8% of total cost in this scenario. At higher node counts (workflows with Iterator/Collector over large arrays), the meter share rises.

CUR Appearance

Bedrock Flows costs appear under the AmazonBedrock product code. CUR 2.0 line_item_usage_type patterns for Flows look like:

{region}-FlowNodeTransition

This is a distinct usage type from model inference ({region}-{model}-input-tokens), so it is filterable in Athena with:

SELECT
  DATE_TRUNC('day', line_item_usage_start_date) AS usage_day,
  SUM(line_item_unblended_cost)                  AS flows_cost,
  SUM(line_item_usage_amount)                    AS node_transitions
FROM cost_usage_report
WHERE product_product_name = 'Amazon Bedrock'
  AND line_item_usage_type LIKE '%FlowNodeTransition%'
GROUP BY 1
ORDER BY 1;

Important: CUR does not carry per-requestId granularity. Flows execution IDs do not appear in CUR line items. For per-flow attribution, join CUR at the usage-type grain to invocation logs (see Section 4), using identity.arn and time window to approximate which flows drove which inference tokens.

Flows vs Agents vs LangChain/LangGraph

Dimension Bedrock Flows Bedrock Agents LangChain / LangGraph
Orchestration style Visual DAG, no code ReAct loop, tool use Code-first graph or chain
Branching Condition nodes Model-driven Arbitrary Python
Tool calling Via Agent or Lambda node Native tool use Arbitrary tool wrappers
Caching integration Inherits from Prompt nodes Partial Full control
Multi-agent Agent nodes can call other Agents Single agent (Supervisors in preview) Full
Cost meter $0.035/1K node transitions + inference $0/orchestration + inference No orchestration meter
Best for Structured pipelines, low-code teams Open-ended reasoning, tool-rich tasks Complex control flow, research systems

When to prefer Flows: Linear or branching pipelines with well-defined steps; teams that need visual debugging and versioning without writing orchestration code; workflows that combine Bedrock Guardrails, Knowledge Bases, and Lambda in a single auditable artifact.

When to prefer Agents: The task requires open-ended reasoning or dynamic tool selection that cannot be modeled as a static DAG; you need native tool-call retry and error handling; you are building a ReAct loop with uncertain step counts.

When to prefer LangChain/LangGraph: You need full control over retry logic, token budgets, prompt caching policy, streaming, or you are running outside AWS. LangGraph adds no Flows-style node-transition meter but adds your own infrastructure cost.

Known Cost Traps

  1. Iterator/Collector over large arrays. If a Flows Iterator fans out over an array of 100 items, each item traversal adds its own node transitions. A 5-node loop body × 100 items = 500 transitions per execution. At $0.035/1K, this is still cheap in isolation, but each iteration also invokes model inference.

  2. Nested Agent nodes. A Flows Agent node invoking a Bedrock Agent that internally calls 10 tool steps adds 10× the expected inference tokens to the flow, plus any Guardrails text units on each agent step. Flows meter only sees the one node transition into the Agent node; the agent’s internal steps are metered separately under Agents.

  3. No Flows-specific provisioned throughput. Flows always runs on-demand. High-volume flows that use the same underlying model should be fronted by Provisioned Throughput reserved on that model; Flows will use the provisioned capacity transparently.

2. Bedrock Prompt Management

What It Is

Prompt Management (GA November 2024) is a Bedrock service for storing, versioning, and deploying prompts as first-class resources with ARNs. Each prompt is a template (system message, user message structure, variable placeholders) paired with a model configuration (model ID, temperature, max tokens, top-P). Teams create a prompt, iterate on it, and publish numbered versions. Application code references prompts by ARN + version number, decoupling prompt content from application deployment.

Pricing: Storage and Versioning

No charge for prompt storage or versioning. Creating 1,000 prompt versions costs $0.00 in prompt management fees. This is confirmed in official AWS documentation and consistent across all third-party analyses reviewed.

The only charges are:

  1. Model inference when executing a prompt — standard on-demand token rates for whichever model is configured on the prompt.
  2. Testing in the console — console test invocations are billed as standard inference on the configured model. There is no “test mode” discount.

Interaction with Prompt Caching

Prompt Management and prompt caching are orthogonal features that can be combined with care:

  • Prompt Management controls which prompt text is sent to the model and adds version governance.
  • Prompt caching controls whether Bedrock reuses a previous KV-cache entry for a matching prefix.

A prompt retrieved via ARN and injected as a system message is eligible for prompt caching on the same basis as any inline system message: the cached prefix must appear at the top of the context and be at least 1,024 tokens long. Prompt Management does not automatically enable or disable caching — the caller must explicitly set cacheControl in the API request.

Practical pattern: Long system prompts stored in Prompt Management are ideal candidates for caching. Store the system prompt in Prompt Management for governance; at runtime, retrieve the prompt ARN and add {"type": "ephemeral"} cache control to the system message. This yields:

  • Governance benefit from Prompt Management (version tracking, rollback, A/B)
  • Latency/cost benefit from caching (up to 90% reduction on cached input tokens)

Cache write cost for Claude models on Bedrock: 1.25× standard input rate. Cache read cost: 0.10× standard input rate. TTL: 5 minutes default, 1-hour option available as of January 2026 for select Claude models. For Amazon Nova models, cache writes have no surcharge.

Prompt Management for A/B Testing

Prompt Management enables controlled A/B testing of prompt versions:

  1. Deploy version N as the production ARN.
  2. Test version N+1 in console or staging; invocations billed as standard inference.
  3. Roll out version N+1 by updating the ARN reference in application code.
  4. Track quality metrics by model invocation log field requestMetadata.prompt_version (set via per-request metadata tagging at call time).

CUR does not distinguish which prompt version drove inference — all tokens from the same model and region look identical. Use invocation logs with requestMetadata tagging to attribute tokens to prompt versions.

3. Bedrock Prompt Optimization

What It Is

Automatic Prompt Optimization is a Bedrock feature (GA 2025) that uses an LLM to rewrite a user-supplied prompt to improve its effectiveness on a target model. Two tiers exist:

  • Simple Prompt Optimizer — a lightweight rewrite pass.
  • Advanced Prompt Optimizer (new, May 2026) — a more intensive multi-pass optimization that includes meta-prompting and automated evaluation steps.

Pricing

Simple Prompt Optimizer: $0.03 per 1,000 tokens (input prompt tokens + resulting optimized prompt tokens). This is a flat meter separate from the target model inference.

Advanced Prompt Optimizer: Billed at standard on-demand inference rates for whatever model performs the optimization internally. AWS does not publish which specific model runs the optimizer, but the charges appear as standard model inference tokens in CUR under the optimizer model’s usage type. Callers pay for both the optimization step and any subsequent inference on the optimized prompt — there is no bundling.

Cost-Positive vs. Cost-Negative Threshold

Optimization is cost-positive (net savings) when the quality improvement reduces retry/correction rates enough to lower total inference volume. It is cost-negative when the optimized prompt is longer (more input tokens) or when the use case does not require quality improvement.

Scenario Verdict
One-time batch job: run optimizer once, use optimized prompt forever Cost-positive after ~50 production executions
Per-request optimization: optimize a new prompt on every user turn Cost-negative for most workloads; adds 1–5× the token overhead
Reducing structured output failure rate from 15% → 2% Cost-positive if the model is expensive and retries are frequent
Simple factual Q&A with high-quality base prompt Cost-neutral to slightly negative

Rule of thumb: Simple Optimizer is worth running once at prompt development time for any prompt that will be executed >100 times in production. Advanced Optimizer is worth running when structured output or multi-step reasoning failure rates are above 5%.

CUR Appearance

Advanced Optimizer tokens appear as standard inference under the optimizer model’s usage type. There is no dedicated PromptOptimization usage type in CUR — the tokens are indistinguishable from regular inference unless the caller sets requestMetadata tags (e.g., {"job": "prompt-optimization"}). Simple Optimizer has its own meter that may appear as a distinct usage type; treat its $0.03/1K rate as a secondary line in analysis.

4. Bedrock Model Invocation Logging

What It Is

Model Invocation Logging captures the full request and response for every Bedrock inference call — prompts, responses, token counts, IAM identity, request metadata — and ships it to S3 or CloudWatch Logs. It is disabled by default and must be explicitly enabled per account per region.

Supported Operations

Logging covers Converse, ConverseStream, InvokeModel, and InvokeModelWithResponseStream via the bedrock-runtime endpoint. The Responses API (bedrock-mantle endpoint) is not currently captured by invocation logging. Image and document data passed via Converse are logged to S3 only (not CloudWatch).

Log Schema

Each log entry is a JSON object:

{
  "schemaType": "ModelInvocationLog",
  "schemaVersion": "1.0",
  "timestamp": "2026-06-17T12:00:00Z",
  "accountId": "123456789012",
  "region": "us-east-1",
  "requestId": "abcd1234-5678-efgh-ijkl-mnopqrstuvwx",
  "operation": "Converse",
  "modelId": "anthropic.claude-sonnet-4-20250514-v1:0",
  "identity": {
    "arn": "arn:aws:sts::123456789012:assumed-role/ProdRole/session-name"
  },
  "requestMetadata": {
    "team": "orchestrator",
    "environment": "production",
    "prompt_version": "v3"
  },
  "input": {
    "inputContentType": "application/json",
    "inputBodyJson": {},
    "inputTokenCount": 512
  },
  "output": {
    "outputBodyJson": {},
    "outputTokenCount": 128
  }
}

Fields populated automatically: all except requestMetadata. The requestId field is the primary join key for per-request cost attribution.

CUR ↔ Log Join Pattern

CUR does not carry per-request line items — it aggregates by model, usage type, and hour. To attribute cost to individual prompts or features:

  1. Enable invocation logging to S3.
  2. Crawl the S3 bucket with AWS Glue to create an Athena table.
  3. Join at the model + usage-type + hour grain to allocate CUR costs proportionally, or sum token counts from logs and multiply by per-token rates directly.

Athena query — token cost attribution by IAM principal:

SELECT
  identity.arn                      AS principal,
  modelId,
  SUM(input.inputTokenCount)        AS total_input_tokens,
  SUM(output.outputTokenCount)      AS total_output_tokens,
  COUNT(*)                          AS calls
FROM bedrock_invocation_logs
WHERE DATE(timestamp) = DATE('2026-06-17')
GROUP BY 1, 2
ORDER BY total_input_tokens DESC;

Athena query — cost attribution by requestMetadata tag:

SELECT
  requestMetadata['team']           AS team,
  requestMetadata['prompt_version'] AS prompt_version,
  SUM(input.inputTokenCount)        AS total_input_tokens,
  SUM(output.outputTokenCount)      AS total_output_tokens,
  COUNT(*)                          AS calls
FROM bedrock_invocation_logs
WHERE DATE(timestamp) = DATE('2026-06-17')
GROUP BY 1, 2
ORDER BY total_input_tokens DESC;

S3 vs. CloudWatch Logs: Cost Comparison

Dimension S3 CloudWatch Logs
Ingestion cost ~$0.005/GB (PUT requests) $0.50/GB ingested
Storage cost ~$0.023/GB/month (Standard) ~$0.03/GB/month
Query tool Amazon Athena ($5/TB scanned) CloudWatch Logs Insights ($0.005/GB scanned)
Size limit for inline bodies 100 KB (larger → separate S3 object) 100 KB (larger → S3 if configured)
Real-time streaming Via EventBridge or Kinesis Direct CloudWatch Logs subscription filters
Recommendation Production at scale Dev/debug or small workloads

Cost calculation at scale: At 10 million invocations/day with 500-byte average log entry (metadata only, no large bodies):

Daily volume: 10M × 500B = 5 GB/day
CloudWatch ingestion: 5 GB × $0.50 = $2.50/day → $75/month
S3 ingestion:         5 GB × $0.005 = $0.025/day → $0.75/month

At this volume, S3 is 100× cheaper for ingestion. CloudWatch makes sense only when you need real-time alerting on invocation patterns (e.g., anomaly detection on token spikes via CloudWatch alarms).

PHI/PII Implications

Invocation logs contain the full prompt and response bodies, including any PHI or PII in user messages or model outputs. Key controls:

  1. S3 bucket encryption: Enable SSE-KMS; the bucket ACL must be disabled for the Bedrock bucket policy to take effect.
  2. Access control: Restrict s3:GetObject on the logging bucket to the minimum set of IAM principals (log analysts, compliance tooling).
  3. Log routing for HIPAA workloads: Store logs in a HIPAA-eligible S3 bucket with an active BAA. CloudWatch Logs is also HIPAA-eligible but adds $0.50/GB ingestion cost.
  4. Selective logging: If PHI appears only in a subset of workflows, route those workflows through a separate Bedrock account or region with logging disabled, and log only the non-PHI workloads in the primary account.
  5. Do not place PII in requestMetadata: Metadata values are stored unencrypted in log records and passed to any system that reads those logs.

Log Retention Cost Model

Retention period CloudWatch monthly cost per GB stored S3 monthly cost per GB stored
7 days ~$0.007 ~$0.005
30 days ~$0.03 ~$0.023
1 year ~$0.03 (S3 glacier for CW export) ~$0.023 (S3 IA for objects > 30 days)

Recommended lifecycle policy: raw invocation logs → S3 Standard for 30 days → S3 Standard-IA for 60 days → S3 Glacier Instant Retrieval for 2 years → expire. For compliance retention of 7 years, Glacier Deep Archive at $0.00099/GB/month is the lowest-cost option.

5. Bedrock Studio

What It Is

Bedrock Studio is a web-based IDE (launched GA 2024) for collaborative prompt development, model comparison, and prototyping. It integrates with AWS IAM Identity Center (SSO) and allows teams to share workspaces, compare model outputs side-by-side, and iterate on prompts and flows without writing code. It is the recommended onboarding surface for non-engineers building on Bedrock.

Pricing

No per-seat or per-workspace fee. Bedrock Studio itself is free. The only charges are standard Bedrock inference fees for models invoked through the Studio interface.

Studio activity is billed identically to production inference: every prompt test run in Studio generates model inference tokens charged at the same on-demand rates. There is no “sandbox” or “console-test” discount tier.

How Studio Activity Appears in Billing

Studio invocations are attributed to the IAM Identity Center identity that runs them. With IAM principal-based cost attribution enabled (GA April 2026), each developer’s Studio usage generates CUR 2.0 entries tagged with their IAM ARN. This makes it possible to break out developer experimentation costs from production traffic.

Recommended governance pattern:

  1. Create a dedicated BedrockStudio-Dev IAM role for Studio users.
  2. Activate IAM principal cost allocation tags in the Billing console.
  3. Set a monthly budget alert on the BedrockStudio-Dev role’s spend using AWS Budgets.
  4. Apply Bedrock Guardrails in the Studio workspace to prevent expensive open-ended generation during development (e.g., max tokens cap).

Without this pattern, a team of 10 developers experimenting freely with Claude Opus-class models can generate $500–$2,000/month in Studio inference charges that are invisible against production traffic in Cost Explorer.

Studio vs. Production Inference Isolation

Studio does not have a separate API endpoint or service code in CUR. The only distinguishing attribute is the IAM identity. CUR query to separate Studio from production:

SELECT
  DATE_TRUNC('month', line_item_usage_start_date) AS month,
  SUM(CASE WHEN line_item_iam_principal LIKE '%BedrockStudio%'
           THEN line_item_unblended_cost ELSE 0 END) AS studio_cost,
  SUM(CASE WHEN line_item_iam_principal NOT LIKE '%BedrockStudio%'
           THEN line_item_unblended_cost ELSE 0 END) AS production_cost
FROM cost_usage_report
WHERE product_product_name = 'Amazon Bedrock'
GROUP BY 1;

This requires a consistent naming convention for Studio IAM roles/users.

6. Bedrock Marketplace

What It Is

Bedrock Marketplace (GA December 4, 2024) expands the Bedrock model catalog from ~30 first-party models to over 100, including open-weight, specialized, and fine-tuned models from independent providers. Examples include IBM Granite, Stability AI Stable Diffusion 3.5, Upstage Solar Pro (Korean), and EvolutionaryScale ESM3 (protein structure). Models are discovered in the Bedrock console, subscribed to via AWS Marketplace, and deployed to managed SageMaker endpoints.

Architecture Difference: Marketplace ≠ Serverless Bedrock

This is the most important billing distinction. Standard Bedrock models (Claude, Llama, Nova, Mistral) are serverless: you pay per token with no idle cost and no infrastructure to manage. Bedrock Marketplace models run on dedicated SageMaker endpoints — you choose an instance type, launch it, and pay per hour whether or not the endpoint is processing requests.

Dimension Standard Bedrock Bedrock Marketplace
Infrastructure Serverless (AWS-managed) SageMaker endpoint (customer-launched)
Pricing model Per-token, on-demand Per-instance-hour (SageMaker pricing)
Software fee None (first-party) / provider rate Varies by ISV; can be $0 or a per-hour/per-token subscription fee
Idle cost None Full instance-hour cost even at 0 requests
CUR product code AmazonBedrock AmazonSageMaker (infrastructure) + potentially AWSMarketplace (software)
Auto-scaling AWS-managed Customer-configured SageMaker endpoint scaling

Pricing Patterns

Three patterns are observed across Marketplace models:

  1. Infrastructure-only (software fee = $0): Common for open-weight models (LLaMA variants, Mistral fine-tunes). You pay SageMaker endpoint instance hours only. Example: ml.g5.48xlarge at ~$16.29/hour = ~$11,729/month for always-on deployment.

  2. Software subscription + infrastructure: ISV charges a per-hour or per-token software fee billed through AWS Marketplace, on top of SageMaker instance hours. This appears as two separate line items in CUR: the infrastructure cost under AmazonSageMaker and the software fee under AWSMarketplace with a separate product code from the ISV.

  3. Private Offer / Enterprise License: Available via managed-entitlements workflow. Subscribe once from an organization management account and distribute access to member accounts. License usage appears in AWS License Manager. Billing follows the contract negotiated in the Private Offer.

CUR Appearance vs. Standard Bedrock

Standard Bedrock inference:
  product_product_name = 'Amazon Bedrock'
  line_item_usage_type = 'USE1-Claude4.6Sonnet-input-tokens'

Bedrock Marketplace model inference:
  product_product_name = 'Amazon SageMaker'
  line_item_usage_type = 'USE1-ml.g5.48xlarge'  (or relevant instance)

Bedrock Marketplace software fee (if applicable):
  product_product_name = 'AWS Marketplace'
  line_item_usage_type = '{ISV-specific product code}'

This split means a naive WHERE product_product_name = 'Amazon Bedrock' query will miss all Marketplace model costs. A complete Bedrock total-cost query must union across AmazonBedrock, the relevant AmazonSageMaker endpoint lines, and any AWSMarketplace software fees attributable to AI model subscriptions.

Notable Marketplace Models and Estimated Pricing (mid-2026)

Model Provider Use case Approx. infra cost
IBM Granite 3.0 8B IBM Enterprise code + text ml.g5.2xlarge ~$1.21/hr
Stable Diffusion 3.5 Large Stability AI Image generation ml.g5.xlarge ~$1.01/hr
Solar Pro 22B Upstage Korean-language tasks ml.g5.12xlarge ~$5.67/hr
ESM3 7B EvolutionaryScale Protein structure ml.g5.2xlarge ~$1.21/hr

Software fees are set by each ISV and displayed during the subscription flow; they change independently of AWS pricing.

7. Unified Cost Governance Across All Bedrock Service Lines

Service Line Map

Service Meter Approx. rate CUR product code
Standard inference Input/output tokens Model-specific AmazonBedrock
Prompt caching Cache write + cache read tokens 1.25× in / 0.10× in AmazonBedrock
Bedrock Flows Node transitions $0.035/1K AmazonBedrock
Bedrock Agents No orchestration meter; inference only Standard token rates AmazonBedrock
Guardrails Text units $0.15/1K text units AmazonBedrock
Knowledge Bases (OpenSearch) OCU-hours + storage ~$0.24/OCU-hr; min 2 OCUs AmazonOpenSearchService
Knowledge Bases (S3 Vectors) Storage + query ~$0.01/GB/month + $0.10/1K queries AmazonS3
Model Invocation Logging (S3) S3 PUT + storage ~$0.005/GB in + $0.023/GB/mo AmazonS3
Model Invocation Logging (CW) CW ingestion + storage $0.50/GB in + $0.03/GB/mo AmazonCloudWatch
Prompt Management None (free) $0 N/A
Simple Prompt Optimizer Optimizer tokens $0.03/1K tokens AmazonBedrock
Advanced Prompt Optimizer Model inference Standard rates AmazonBedrock
Bedrock Studio None (free); inference billed Standard rates AmazonBedrock
Bedrock Marketplace (infra) SageMaker instance-hours SageMaker pricing AmazonSageMaker
Bedrock Marketplace (software) ISV fee ISV-set AWSMarketplace
Cross-region inference Token surcharge ~20% premium AmazonBedrock

Full Bedrock Total-Cost Athena Query

-- Total Bedrock ecosystem spend by service line, current month
WITH bedrock_core AS (
  SELECT
    'Inference + Flows + Guardrails' AS service_line,
    SUM(line_item_unblended_cost)    AS cost
  FROM cost_usage_report
  WHERE product_product_name = 'Amazon Bedrock'
    AND DATE_FORMAT(line_item_usage_start_date, '%Y-%m') = '2026-06'
),
bedrock_opensearch AS (
  SELECT
    'Knowledge Base (OpenSearch)'    AS service_line,
    SUM(line_item_unblended_cost)    AS cost
  FROM cost_usage_report
  WHERE product_product_name = 'Amazon OpenSearch Service'
    AND DATE_FORMAT(line_item_usage_start_date, '%Y-%m') = '2026-06'
    -- Filter to Bedrock KB OCUs if using resource tags
),
bedrock_marketplace_infra AS (
  SELECT
    'Marketplace Models (SageMaker)'  AS service_line,
    SUM(line_item_unblended_cost)     AS cost
  FROM cost_usage_report
  WHERE product_product_name = 'Amazon SageMaker'
    AND DATE_FORMAT(line_item_usage_start_date, '%Y-%m') = '2026-06'
    -- Narrow with resource tags: WHERE resource_tags_user_bedrock_marketplace = 'true'
),
bedrock_marketplace_software AS (
  SELECT
    'Marketplace Models (Software Fee)' AS service_line,
    SUM(line_item_unblended_cost)        AS cost
  FROM cost_usage_report
  WHERE product_product_name = 'AWS Marketplace'
    AND DATE_FORMAT(line_item_usage_start_date, '%Y-%m') = '2026-06'
    -- Narrow to AI model subscriptions with tags
),
logging_infra AS (
  SELECT
    'Invocation Logging (S3/CW)'     AS service_line,
    SUM(line_item_unblended_cost)    AS cost
  FROM cost_usage_report
  WHERE product_product_name IN ('Amazon S3', 'AmazonCloudWatch')
    AND DATE_FORMAT(line_item_usage_start_date, '%Y-%m') = '2026-06'
    -- Tag: WHERE resource_tags_user_bedrock_logging = 'true'
)
SELECT service_line, ROUND(cost, 2) AS monthly_cost
FROM (
  SELECT * FROM bedrock_core
  UNION ALL SELECT * FROM bedrock_opensearch
  UNION ALL SELECT * FROM bedrock_marketplace_infra
  UNION ALL SELECT * FROM bedrock_marketplace_software
  UNION ALL SELECT * FROM logging_infra
)
ORDER BY monthly_cost DESC;

Note: OpenSearch, SageMaker, S3, and CloudWatch line items require consistent resource tagging to isolate Bedrock-related usage from other services sharing those product codes. The recommended approach is to apply a bedrock-workload tag to all resources provisioned for Bedrock (KB collections, logging buckets, Marketplace endpoints) and activate it as a cost allocation tag.

CUDOS Coverage

AWS CUDOS (Cost and Usage Dashboards Operations Solution) covers AmazonBedrock inference metrics natively as of 2025. Marketplace SageMaker costs and Knowledge Base OpenSearch costs require custom CUDOS extensions or supplemental QuickSight datasets with tag-based filtering. CUDOS does not yet auto-identify Bedrock-tagged SageMaker endpoints as AI workloads separate from other SageMaker use.

IAM Principal Attribution (GA April 2026)

As of April 2026, Bedrock supports automatic IAM principal cost attribution in CUR 2.0 without any API change. When a developer, application role, or Bedrock service (Flows, Agents) makes an inference call, the IAM ARN of the caller is recorded in the line_item_iam_principal CUR column. This enables:

  • Per-developer Studio spend breakdown
  • Per-application-role production cost isolation
  • Bedrock Agents vs. Flows vs. direct-invoke cost comparison (when each uses a distinct IAM role)

Activation: go to AWS Billing Console → Cost Allocation Tags → IAM Principal Tags → activate. Allow 24–48 hours for backfill to begin.

Hard Edges and Known Gaps

Risk Description Mitigation
CUR misses Marketplace costs Marketplace model costs land under AmazonSageMaker + AWSMarketplace, not AmazonBedrock Tag all Marketplace endpoints and union across product codes
Flows Agent node token multiplication A single Flows Agent node can trigger 10+ model calls internally; Flows meter only counts 1 transition Monitor per-agent-step tokens in invocation logs, not just Flows meter
OpenSearch Serverless floor Any Knowledge Base using OpenSearch has a ~$350/month floor (2 OCUs); switching to S3 Vectors drops floor to near-zero Evaluate S3 Vectors for workloads below ~100K daily queries
CloudWatch ingestion cost at scale $0.50/GB ingestion makes full-body logging expensive at >1M invocations/day Route full-body logging to S3; use CloudWatch only for metadata
bedrock-mantle endpoint not logged The Responses API endpoint is excluded from invocation logging as of mid-2026 Use bedrock-runtime Converse API if invocation logging is required; track bedrock-mantle via CloudWatch Metrics
Prompt Optimization tokens not tagged Advanced Optimizer tokens appear as standard inference with no distinguishing usage type Set requestMetadata: {"job": "prompt-optimization"} on optimization calls
Cache write surcharge for Claude Cache writes cost 1.25× standard input; workloads with short prompts or high TTL misses can exceed caching benefit Only cache system prompts >1,024 tokens with high reuse frequency
Provisioned Throughput idle cost PT is billed per hour regardless of request volume; under-utilized PT is pure waste Monitor PT utilization; release commitments when utilization drops below ~60%

Verification Ledger

Claim Source Confidence
Flows: $0.035/1K node transitions aws.amazon.com/bedrock/pricing/ Official docs verified
Flows: billing effective Feb 1, 2025 AWS pricing page Official docs verified
Flows: CUR usage type {region}-FlowNodeTransition Inferred from CUR naming convention; not explicitly documented Inference — verify in active account CUR
Prompt Management: free storage/versioning AWS pricing page + multiple third-party sources Official docs verified
Prompt Optimization simple: $0.03/1K tokens AWS pricing page Official docs verified
Prompt Optimization advanced: standard inference rates AWS InfoWorld coverage + pricing page Official docs verified
Invocation logging: S3 and CW supported docs.aws.amazon.com/bedrock/latest/userguide/model-invocation-logging.html Official docs verified
Invocation logging: 100KB inline body limit AWS docs Official docs verified
Invocation logging: bedrock-mantle not covered AWS docs note Official docs verified
CW ingestion: $0.50/GB CloudWatch pricing page (referenced in cloudburn.io analysis) Official docs verified
Marketplace: SageMaker-backed, not serverless AWS News Blog Dec 4, 2024 Official docs verified
Marketplace: CUR under AmazonSageMaker Inferred from architecture (SageMaker-backed endpoints) Inference — verify in active account CUR
IAM principal attribution GA April 2026 aws.amazon.com/about-aws/whats-new/2026/04/bedrock-iam-cost-allocation Official docs verified
Bedrock Studio: no per-seat fee Multiple third-party sources; AWS pricing page absence of Studio charges Official docs verified (absence)
Prompt cache TTL 1-hour option aws.amazon.com/about-aws/whats-new/2026/01/amazon-bedrock-one-hour-duration-prompt-caching Official docs verified
Cache write: 1.25× for Claude, 0× for Nova AWS pricing + caylent.com analysis Official docs verified

Next Research Lanes

  1. Flows CUR usage type confirmation: Spin up a minimal Flows workflow in a dev account, run 10 executions, and query CUR 2.0 for the exact line_item_usage_type string for node transitions. The {region}-FlowNodeTransition pattern is inferred, not confirmed from a live CUR extract.

  2. bedrock-mantle observability gap: The Responses API endpoint (bedrock-mantle) is excluded from invocation logging. Research whether CloudWatch Metrics for bedrock-mantle capture token-level data, and whether a workaround (OpenTelemetry wrapping at the SDK layer) is viable for compliance logging.

  3. Advanced Prompt Optimizer model identity: AWS has not published which foundation model runs the Advanced Optimizer. Identify via CUR inspection: after running a batch of optimizations, look for unexpected model inference line items in the same time window.

  4. S3 Vectors Knowledge Base cost at scale: S3 Vectors is the low-floor alternative to OpenSearch Serverless for Knowledge Bases. Research the query-cost curve at 100K, 1M, and 10M daily retrievals to establish the OpenSearch → S3 Vectors break-even point.

  5. Marketplace Private Offer billing mechanics: The managed-entitlements flow for org-wide Marketplace model distribution is sparsely documented for billing. Research how Private Offer usage aggregates across member accounts in CUR and whether License Manager provides a unified usage dashboard.