AWS Bedrock

The AWS Bedrock connector combines CloudTrail management and data events (who invoked which model, from which role) with Bedrock model invocation logging (request and response bodies with token counts, delivered to S3 or CloudWatch Logs). PromptGlass ingests both across one account or a whole AWS Organization. It attributes usage to IAM principals, maps them to people and teams, and runs detection on prompt content.

Prerequisites

• Model invocation logging turned on in each Region you use (Bedrock → Settings → Model invocation logging), delivering to S3.
• An organization CloudTrail trail (recommended), or per-account trails.

IAM role for PromptGlass

{
  "Version": "2012-10-17",
  "Statement": [
    { "Effect": "Allow", "Action": ["s3:GetObject", "s3:ListBucket"],
      "Resource": ["arn:aws:s3:::acme-bedrock-logs", "arn:aws:s3:::acme-bedrock-logs/*"] },
    { "Effect": "Allow", "Action": ["kms:Decrypt"], "Resource": "arn:aws:kms:*:111122223333:key/*",
      "Condition": { "StringEquals": { "kms:ViaService": "s3.us-east-1.amazonaws.com" } } },
    { "Effect": "Allow", "Action": ["bedrock:ListFoundationModels", "bedrock:GetModelInvocationLoggingConfiguration",
                                    "ce:GetCostAndUsage", "organizations:ListAccounts"], "Resource": "*" }
  ]
}

Trust the PromptGlass AWS account with an external ID shown in the console. For self-hosted installs, use IRSA or the node’s instance role instead.

promptglass connectors add aws-bedrock \
  --role-arn arn:aws:iam::111122223333:role/PromptGlassReader \
  --external-id pg-7d2e… \
  --invocation-log-bucket acme-bedrock-logs --regions us-east-1,eu-west-1

Attribution

Bedrock calls usually come from application roles, not people. PromptGlass maps them like this:

1. aws:userid session tags or x-promptglass-user passed in requestMetadata, when the app sets them
2. IAM Identity Center users for console and CLI use
3. A role-to-application mapping that you define, with an owner team and cost center

Cost

Token counts from the invocation logs are priced with the on-demand rates for each model and Region. When you connect Cost Explorer, provisioned-throughput costs are reconciled against billed amounts.