Jamf built Bedrock spend limits for under $10 a month

Jamf cuts an engineer's access to Claude models within minutes of a blown spend cap, without forcing a fresh login, per AWS. Hundreds of engineers stay covered for under $10 a month, built from AWS services the company already pays for.

AWS lays out the mechanics in its Bedrock writeup. Invocation logs stream to S3 carrying model ID, token counts, and the calling user's IAM Identity Center identity. An Athena view turns that into per-user daily spend. Every 15 minutes, a Lambda function on an EventBridge schedule checks who's over budget and rewrites their Customer Managed Policy with iam:CreatePolicyVersion. IAM evaluates the new policy on the user's next API call, so the block takes effect immediately. No token revocation, no session kill, no support ticket.

The system doesn't cut a user off outright. It denies Opus once someone crosses 80% of their daily budget, denies Sonnet at 100%, and leaves a cheaper model reachable the whole time. An engineer who burns through budget on the expensive model keeps working, just on something that costs less.

AWS's post doesn't say what happens at larger log volume, or whether the 15-minute window holds if usage spikes faster than that.