Jamf enforces per-user Bedrock spend caps in minutes using IAM policy rewrites, for under $10 a month

AWS Machine Learning Blog·medium signalXBlueskyLinkedInCopy link

Jamf's writeup details a three-part serverless setup: Bedrock invocation logs to S3 carrying model ID, token counts and IAM Identity Center user identity; an Athena view computing per-user daily spend; and a Lambda on a 15-minute EventBridge schedule that rewrites Customer Managed Policies via iam:CreatePolicyVersion. Denials take effect within minutes without re-authentication because IAM evaluates the updated policy on the next Bedrock call. The tiering is the interesting part, denying Claude Opus at 80% of daily budget and Sonnet at 100% while leaving a cheap model always reachable, and the whole thing runs well under $10/month for hundreds of engineers.