Onaro™ONARO
OverviewImplementationExtraction guides

Documentation / Integrations / AWS Bedrock

AWS Bedrock connector

Beta — implemented and listed for early use. Confirm the first sync in a non-production window before relying on it for close.

Connect AWS credentials to pull Amazon Bedrock spend from Cost Explorer (Beta).

Status: Beta · Claim C-23

Overview

Connect AWS credentials to pull Amazon Bedrock spend from Cost Explorer (Beta).

Data pulled

  • Daily Bedrock spend from Cost Explorer
  • Token counts are not provided (cost only)

Authentication & credential storage

Meridian stores the following fields for this connector (values encrypted at rest):

  • api_key (access key id)
  • aws_secret_key
  • region (optional)
  • Credentials are encrypted with AES-256-GCM using a KMS-wrapped data encryption key (DEK) and stored in vendor_connections.credentials_encrypted.
  • Meridian never returns the plaintext key after save. Revocation is disconnect: deactivate or delete the vendor connection — sync stops and the encrypted blob is no longer used.
  • IAM needs ce:GetCostAndUsage and sts:GetCallerIdentity. Cost Explorer is queried from us-east-1.

Sync schedule & behavior

AWS Cost Explorer often lags 24–48 hours. Syncs automatically every 6 hours; manual sync anytime. There is no per-connection frequency setting.

Setup steps

  1. Create an IAM user or role with Cost Explorer read access.
  2. Connect AWS Bedrock in Meridian with access key, secret, and optional region.
  3. Verify spend after the Cost Explorer lag window.

Troubleshooting

  • AccessDenied on ce:GetCostAndUsage: attach the Cost Explorer policy.
  • Empty results: wait 24–48h; confirm Bedrock usage is in the linked account.

Related