Amazon Bedrock adds per-user cost attribution in CUR 2.0

The new capability addresses a common attribution problem: when developer and productivity tools run on each user's machine and call Bedrock through a shared IAM role, billing aggregates spend to a single principal. With IAM Identity Center, the session name becomes the user's sign-in name, so each user gets their own principal, and session tags (team, cost center) can enrich the data in CUR 2.0. The post outlines a step-by-step setup with IAM Identity Center, external IdP, and CUR 2.0 configuration, and notes that the mechanism supports four access patterns: IAM users, per-application roles, federated identities, and LLM gateways proxying to Bedrock. For organizations that need enforcement beyond visibility, Bedrock-native usage controls such as AWS Budgets, CloudWatch alarms, DynamoDB-based quota tracking, and LLM gateway proxies offer different trade-offs in enforcement latency and operational complexity.