Jamf's Bedrock controls restrict costly models as engineers reach daily limits

Jamf has built a per-user cost-control system for Amazon Bedrock that gradually removes access to expensive models as an engineer approaches a daily budget. The design keeps a cheaper model available so work can continue rather than imposing a complete cutoff.

Bedrock invocation logs record model, token counts and user identity in Amazon S3. An Athena query converts that activity into daily spending, and an AWS Lambda function checks the totals every 15 minutes. In Jamf's example policy, access to Anthropic's Claude Opus is denied at 80% of budget and Claude Sonnet at 100%, while Claude Haiku remains available. Updated identity policies take effect on the next request without requiring a new login.

The restricted list is recalculated from scratch on every run, so access returns automatically when the daily window resets. Administrators can grant audited, time-limited exceptions through Slack for migrations or evaluations that need a higher ceiling. AWS says the supporting Lambda, DynamoDB and S3 services cost under $10 a month for hundreds of engineers in this deployment, excluding Athena costs, which depend on how much log data each query scans.