AWS extended IAM principal cost allocation to the bedrock-mantle endpoint on August 11, 2026. The capability was previously available only for the bedrock-runtime endpoint. It now covers both.
For cloud platform owners and application teams, this closes a real visibility gap. The bedrock-mantle endpoint handles OpenAI-compatible API traffic. It routes requests through the Responses API and Chat Completions API, making it the path of choice for teams migrating workloads or building against a standard interface.
Until now, those requests produced no identity-level cost data.
What the Feature Actually Does
Amazon Bedrock automatically captures the IAM identity for every inference request. No code change is required on the API call itself. Identity capture happens at the service layer.
What you get from that identity depends on how you have tagged your principals. At minimum, the line_item_iam_principal column in CUR 2.0 records the caller's full IAM ARN — the user ID, role name, or assumed-role session — for every Bedrock request. That alone lets you see which principals are driving spend.
If you apply tags to those principals, the tags flow into billing automatically. Common dimensions include team, department, cost center, and environment. Tag values appear in CUR 2.0 with the prefix iamPrincipal/ to distinguish them from resource tags. You can group or filter on them in AWS Cost Explorer or query them at line-item level in a CUR 2.0 export.
The granularity is important to understand. Attribution flows into Cost Explorer and CUR 2.0 at the usage-type-per-day grain, tied to caller identity or tag — not per individual request. For per-prompt token detail, you need separate per-request metadata tagging combined with model invocation logging. Those are complementary tools, not the same thing.
One more boundary: model invocation logging currently captures calls made through bedrock-runtime only. Calls through bedrock-mantle are not captured by invocation logging. Cost allocation through IAM principals fills part of that gap, but teams that rely on invocation logs for audit or debugging will find that bedrock-mantle traffic is outside that pipeline.
Why This Matters for Teams Running AI at Scale
GenAI inference costs accumulate fast and in ways that AWS account-level billing does not naturally surface. A single shared role making thousands of calls per day across a dozen applications looks like one line item. You cannot tell which team, product, or service is driving the bill.
IAM principal attribution combined with per-request metadata tagging gives most production deployments the coverage they need for accurate chargeback and resource planning. The bedrock-mantle expansion means teams do not have to choose between using the OpenAI-compatible interface and having cost visibility. Both now work together.
For organizations using federated identity — Okta, Microsoft Entra, AWS IAM Identity Center — session tags passed through AWS STS at role assumption carry user and team attributes into billing. A gateway that assumes a Bedrock role per user or tenant and passes session tags on each assumption gets per-user billing attribution using temporary role credentials rather than long-lived per-user keys. That is the practical pattern for multi-tenant AI platforms.
Enabling caller identity data increases the number of CUR rows by a factor of the number of distinct calling identities per model, resulting in larger file sizes. Teams with many concurrent users and high request volume should account for the additional S3 storage before enabling the feature in production.
What to Do Next
If your team calls Bedrock through bedrock-mantle and has not yet activated IAM principal cost allocation, the setup has three steps.
First, apply tags to the IAM users and roles that call Bedrock. Tag keys such as team, department, cost-center, and environment aggregate cleanly in Cost Explorer. Avoid high-cardinality values like session IDs or timestamps — those bloat the tag space without improving reporting.
Second, activate those tags as cost allocation tags in the AWS Billing and Cost Management console. Tags do not appear in Cost Explorer or CUR until activated, and activation is not retroactive. Allow up to 24 hours for tag keys to appear on the cost allocation tags page, then allow up to another 24 hours after activation for the tags to become active.
Third, create a new CUR 2.0 export and select "Include caller identity (IAM principal) allocation data" under Additional export content. An existing export will not backfill identity data. You need a new export configuration.
The feature is available in all AWS Regions where bedrock-mantle is supported. No API changes are required in your application code.
If your team runs a shared LLM gateway that proxies Bedrock traffic for multiple users or services, caching assumed-role credentials for the session lifetime avoids STS rate quota issues that can occur when the gateway re-assumes a role on every individual request.
For teams that need both invoice-level cost accuracy and per-prompt token detail, use IAM principal attribution for billing. For bedrock-runtime traffic, pair per-request metadata tagging with model invocation logging for prompt-level analysis. Bedrock-mantle calls are not currently captured by model invocation logging, so teams using that endpoint need a separate application-level telemetry path for per-prompt detail.
