docs: AWS Bedrock cost attribution with STS session tags cookbook - #1055
Open
naresh4dev wants to merge 5 commits into
Open
docs: AWS Bedrock cost attribution with STS session tags cookbook#1055naresh4dev wants to merge 5 commits into
naresh4dev wants to merge 5 commits into
Conversation
…tags Add a comprehensive guide covering end-to-end setup for forwarding Portkey metadata as AWS STS session tags during Bedrock AssumeRole calls. Covers gateway configuration, IAM permissions (caller + target trust policy), SDK/cURL examples, CloudTrail verification, Cost Explorer activation, tag sanitisation constraints, credential caching, and troubleshooting common errors. Also updates the existing assumed-role doc with minimum gateway version, clearer IAM guidance, and a cross-link to the new cookbook.
Contributor
|
Preview deployment for your docs. Learn more about Mintlify Previews.
|
- Replace real AWS account IDs and role names in the troubleshooting error example with generic placeholders - Expand the Credential Caching section with: cache key composition table, TTL details, cache backend (Redis vs in-memory), when new AssumeRole calls happen, STS call volume estimation formula, and a note about throttling for high-cardinality metadata
sivadurga-d
reviewed
Sep 3, 2026
Remove the raw cache key format string (internal implementation detail) while keeping the parameter table and 'not in cache key' clarification that are useful for users.
Replace the box-drawing character diagram with a Mermaid sequenceDiagram that Mintlify renders natively with interactive zoom/pan controls.
- Move IAM permission setup (caller policy + trust policy) to Step 1 - Move gateway env flag enablement to Step 2 with a warning to complete IAM setup first to avoid AccessDenied on all requests - Add enterprise self-hosted note at the top - Update all step references in troubleshooting section
Contributor
There was a problem hiding this comment.
🔵 Needs a closer look
The detailed gateway-version, caching, IAM, and AWS billing claims require human validation against the linked implementation and AWS behavior.
Pull request overview
Adds an Enterprise self-hosted cookbook for attributing Amazon Bedrock costs by forwarding Portkey metadata as AWS STS session tags.
Changes:
- Documents IAM, gateway, request, CloudTrail, and Cost Explorer setup.
- Explains tag sanitization, credential caching, and troubleshooting.
- Links the assumed-role guide and registers the cookbook in both navigation sections.
File summaries
| File | Description |
|---|---|
product/model-catalog/connect-bedrock-with-amazon-assumed-role.mdx |
Adds version/IAM requirements and cookbook link. |
guides/use-cases/aws-bedrock-cost-attribution-with-sts-session-tags.mdx |
Adds the end-to-end cost-attribution cookbook. |
docs.json |
Adds the cookbook to both Use Cases navigation lists. |
Review details
- Files reviewed: 3/3 changed files
- Comments generated: 0
- Review effort level: Balanced
💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
guides/use-cases/aws-bedrock-cost-attribution-with-sts-session-tags.mdx) covering end-to-end setup for forwarding Portkey metadata as AWS STS session tags during Bedrock AssumeRole callsproduct/model-catalog/connect-bedrock-with-amazon-assumed-role.mdx) with minimum gateway version, clearer IAM guidance, updated model name, and cross-link to the new cookbookdocs.jsonCookbook covers:
AWS_BEDROCK_STS_SESSION_TAGS_ENABLED=truewith ECS, K8s, Docker Compose examplesaws:prefix)Context
Addresses the customer-reported issue where STS session tags were not being forwarded. The feature requires gateway
≥ 2.19.0with theAWS_BEDROCK_STS_SESSION_TAGS_ENABLEDflag. This cookbook provides the missing configuration documentation that was requested.Related gateway PR: https://github.com/Portkey-AI/gateway-enterprise-node/pull/1868
Test plan