Appearance
Amazon Bedrock
Pull your Bedrock spend into Flowstate so foundation-model cost on AWS lands on the same ledger as payroll and projects.
What syncs
| Data | Grain |
|---|---|
| Invoiced cost | Per service and usage type, per day |
Cost Explorer reports money, not tokens, and has no user dimension — per-person attribution comes from the Flowstate Agent. The figures are your billed cost, so Flowstate treats them as authoritative and never adds price-table estimates on top.
What you'll see in Flowstate
- Spend reconciliation — AWS's billed cost next to Agent telemetry. See Spend.
- Per-project attribution — with the Agent, Bedrock calls are attributed to a person, project and cost centre. See Attribution.
- Cost trends — daily burn across model families and usage types.
Getting started
You need an IAM role Flowstate can assume that is allowed to read Cost Explorer.
Flowstate uses Workload Identity Federation, not static keys: you create a role that trusts Flowstate's OIDC issuer, scoped to your organisation, so no access key ever leaves your account.
- Switch on Cost Explorer in the AWS Billing console. This is a one-off, and AWS does not let you switch it off again
- Create an IAM role at IAM → Identity providers that trusts Flowstate's OIDC issuer and allows
ce:GetCostAndUsage - In Flowstate, open Settings → Integrations → Amazon Bedrock, paste the role ARN and region, then click Verify and connect — Flowstate makes one read-only call to check it works before saving anything
How syncing works
Spend syncs hourly, and the first connect backfills history automatically.
Two things worth knowing before you enable it:
- Cost Explorer holds 13 months of history, which is the ceiling on the first backfill.
- The first time you switch Cost Explorer on, AWS prepares the back catalogue in the background. The current month appears in about 24 hours; the rest takes a few days. An empty first sync right after enabling is expected, not a fault.
- AWS charges $0.01 per paginated Cost Explorer request. Hourly syncs are cheap, but the cost is not zero and it belongs on your AWS bill, not ours.
If the role or its trust policy is wrong, the connection shows the real AWS error on its provider page.