Bedrock will now name who spent the money, and that ends the chargeback excuse

AWS has put an IAM principal dimension into Bedrock billing data: enable one checkbox on a Cost and Usage Report 2.0 export and every inference request is traced back to the principal that made the call ^[1][7]. The usual objection to charging AI spend back to the teams incurring it, that you would first have to build custom instrumentation to know who spent what, no longer holds ^[2].

The mechanism is unglamorous, which is the point. A new `line_item_iam_principal` column gives per-user and per-application visibility, and optional cost allocation tags let you roll spend up by team, project or tenant in Cost Explorer ^[2][3]. AWS says this covers any Bedrock-powered service or application at the granularity you want, including third-party tools such as Claude Code or Codex as well as your own builds ^[4]. So the agentic coding tool your platform team turned on last quarter is now a billable line with a name attached to it.

Part 2 of the AWS write-up covers the reporting path: set up the CUR 2.0 data export through Data Exports with IAM principal data enabled, query it with Athena in standard SQL, then optionally put CUDOS dashboards on top ^[5][6][11]. The specific configuration matters. Under Additional export content you must select "Include caller identity (IAM principal) allocation data", which is what populates the new column and surfaces `iamPrincipal/`-prefixed tags ^[7]. Set time granularity to Hourly for maximum detail and file versioning to overwrite existing report to avoid duplicate data ^[8]. The CUDOS dashboard deploys from CloudFormation, which also stands up the Athena query database ^[13]. There is an optional `agent.md` skill repo, `aws-samples/sample-cur-iam-principal-bedrock-tracking`, that AWS says automates the end-to-end Athena connection when driven by Claude Code, Kiro-CLI or Codex ^[12].

Two costs are worth pricing before anyone promises finance a dashboard. First, enabling principal data inflates the report: usage that was previously one row expands into one row per contributing principal, and AWS advises planning S3 storage and considering lifecycle policies ^[9]. The multiplier on your row count is roughly the number of distinct principals touching each usage line, so the blast radius grows with the size of the team, not the size of the bill ^[1]. Second, this is batch, not live. Rows land hourly and the first export can take up to 24 hours to arrive, so the feedback loop is a daily conversation, not a live meter ^[8][10][2].

The harder limit is structural. Attribution resolves to whichever IAM principal made the call, so if ten engineers share one role, you get role-level numbers and nothing finer ^[3]. AWS is not offering a way out of poor identity hygiene; it is offering a column.

Watch whether CUR file growth pushes large orgs to hourly-to-daily rollups that quietly lose the per-principal detail they enabled it for ^[9]. Watch, too, whether attribution changes behaviour or merely produces a report: Athena is pitched for chargeback processes, CUDOS for pre-built views of your existing structure ^[14]. The number only bites once someone owns it.