Bedrock CloudWatch token metrics match billing, enabling near-real-time spend caps

AWS Budgets lags by hours, so it cannot enforce a tight daily Bedrock limit. AWS/Bedrock CloudWatch metrics by ModelId (input, output, CacheRead, CacheWrite token counts) matched Cost Explorer usage quantities exactly in one day's check, with only about 1 minute of lag, and priced tokens summed to the billed amount. Derive rates from Cost Explorer USAGE_TYPE cost divided by quantity, since us. inference profiles cost 10% more than global. and cache tokens can dominate spend. The metrics have no caller dimension, but CloudTrail plus separate inference profile prefixes per workload can attribute spend, and a per-minute Lambda can attach a deny policy to one role. When reading get-metric-data through the CLI, timestamps may print in local time, which can shift daily buckets by a day.