AWS has documented a native way to attribute Amazon Bedrock costs to people or teams and restrict access when spending crosses a threshold. The pattern combines IAM principal or session tags, Cost Explorer or Cost and Usage Report 2.0, and AWS Budgets actions.
Organizations with one role per user or application can attach static principal tags. Shared roles need session tags added when the role is assumed, and a session tag overrides a principal tag with the same key. After activation as cost-allocation tags, the values can group Bedrock spending in Cost Explorer or appear in a CUR 2.0 export for SQL analysis.
A budget action can attach an IAM deny policy to a user, group or role. Teams might block premium models at 80% of a budget and additional models at 100%, while retaining a cheaper option. This works cleanly only when the affected person has a distinct IAM identity; denying a shared gateway role blocks everyone using it.
The mechanism is not a real-time spending cap. Budget data refreshes up to three times daily, so costs can overshoot before a policy is attached. New tags can take up to 48 hours to appear and begin populating billing data, and activation is generally not retroactive. Workloads needing immediate per-request enforcement still require a gateway or custom control loop.