Onaro™ONARO

Documentation / Integrations / AWS Bedrock

AWS Bedrock connector

Connect AWS credentials to pull Amazon Bedrock spend from Cost Explorer.

AvailableMethod: API

Overview

Connect AWS credentials to pull Amazon Bedrock spend from Cost Explorer.

Data pulled

  • Daily Bedrock spend from Cost Explorer, summed across usage types into one row per day
  • Token counts are not provided (cost only)

What gets attributed

With the AWS connector, Meridian pulls one Amazon Bedrock total per day from Cost Explorer. It does not read cost allocation tags or inference profiles, so these rows arrive unattributed.

To attribute Bedrock spend by department and agent, call models through application inference profiles, tag each profile (for example CostCenter and Agent), activate those keys as cost allocation tags in AWS Billing, and upload the AWS FOCUS export on Uploads. Meridian takes the department from a CostCenter, Department or cost-center tag (or from your account crosswalk), and the agent from an Agent tag whose value matches an agent name in Meridian.

The inference profile ARN is not mapped to an agent by itself; the tags on the profile carry the attribution. Rows with no cost center tag, an unmapped value, or calls made by model ID instead of an application inference profile go to the attribution inbox with the reason shown.

While the AWS Bedrock connector is active, Bedrock rows in a FOCUS upload are held for reconciliation instead of imported, so their tags are not applied. Use one path for Bedrock spend: the connector for a daily total, or FOCUS uploads for attribution.

Authentication & credential storage

Meridian stores the following fields for this connector (values encrypted at rest):

  • api_key (access key id)
  • aws_secret_key
  • region (optional)
  • Credentials are encrypted with AES-256-GCM using a KMS-wrapped data encryption key (DEK) and stored in vendor_connections.credentials_encrypted.
  • Meridian never returns the plaintext key after save. Revocation is disconnect: deactivate or delete the vendor connection — sync stops and the encrypted blob is no longer used.
  • IAM needs ce:GetCostAndUsage and sts:GetCallerIdentity. Cost Explorer is queried from us-east-1.

Sync schedule & behavior

AWS Cost Explorer often lags 24–48 hours. Syncs automatically every 6 hours; manual sync anytime. There is no per-connection frequency setting.

Setup steps

  1. Create an IAM user or role with Cost Explorer read access.
  2. Connect AWS Bedrock in Meridian with access key, secret, and optional region.
  3. Verify spend after the Cost Explorer lag window.

Troubleshooting

  • AccessDenied on ce:GetCostAndUsage: attach the Cost Explorer policy.
  • Empty results: wait 24–48h; confirm Bedrock usage is in the linked account.

Related

Onaro Meridian is FinOps for agentic AI: the system of record that attributes, controls and books what AI agents spend.