From the AWS edition of November 10, 2026
AWS publishes a Bedrock invocation data lake for org-wide token and cost visibility that centralizes full prompts and responses
Amazon Web Services · Cross-SLED AI cost governance · Not region-specific in source
- Publisher
- AWS Artificial Intelligence Blog
- Original publication
- 2026-11-10
- Source retrieved
- 2026-11-11
- Event date
- 2026-11-10
What happened
AWS's November 10, 2026 post provides CloudFormation templates that forward Bedrock invocation logs from linked accounts to a central account, flatten them with Lambda, store Parquet in S3 via Firehose, and query them in Athena, with optional joins to the Cost and Usage Report by IAM ARN and a Quick Sight dashboard. Each record includes model, account, IAM identity, token counts, stop reason and prompt/response text. AWS notes the bucket is KMS-encrypted and that prompts might contain PII, recommending IAM and bucket policy review. It frames this as a tokenomics (AI FinOps) practice.
Why it matters
State and university AI programs face pressure to show where AI spend goes. Per-identity token and cost data supports chargeback across agencies or departments. But centralizing every prompt and response creates a new sensitive data store that may fall under records retention, public records and privacy rules.
Evidence and measured results
Vendor sample architecture. No customer results or cost figures.
Limitations and uncertainty
Vendor sample; not a managed service. Prompt-retention implications for public records are our interpretation. GovCloud deployment not discussed.
Put this evidence to work
Lighthouse Advisory interpretation, grounded in this source. Enriched 2026-11-11; this does not change the original publication date. Each role follows the same checklist so takeaways compare across sources.
Sales
Role takeaway
- Customer problem
- Public-sector AI programs cannot see AI spend by department or model, and centralized logging creates a sensitive data store.
- Stakeholders
- CIO
- Budget office
- Records officer
- Privacy officer
- Discovery questions
- Do you need AI chargeback across departments?
- Would stored prompts be subject to public records or retention rules?
- Who may read prompt text?
- Value hypothesis
- Per-identity token and cost visibility supports accountability and model choices; savings are not shown.
- Potential engagement
- Deploy the data lake for two accounts with a redaction and retention decision.
- Unsupported claims
- Cost savings
- Compliance of storing prompts
- GovCloud suitability
Pre-sales engineering
Role takeaway
- Fit
- Multi-account Bedrock estates.
- Architecture and integration
- CloudWatch Logs destination, Lambda, Firehose, S3 Parquet, Athena, optional CUR 2.0 and Quick Sight.
- Prerequisites
- AWS Organizations structure
- Bedrock logging enabled per account
- KMS keys
- Constraints
- Stores full prompts and responses by default
- Sample, not managed service
- GovCloud not discussed
- Security
- KMS encryption, least-privilege IAM, consider redacting text fields and setting S3 lifecycle retention.
- Proof of value
- Reconcile cost-by-team to bill
- Access review of bucket
Delivery
Role takeaway
- Work
- Stand up AI cost visibility with a prompt-retention decision.
- Dependencies
- Records guidance
- Access model
- CUR 2.0
- Ownership
- FinOps/platform team; data owner for prompt archive.
- Skills and adoption
- Finance and IT staff learn token economics.
- Governance checkpoints
- Retention schedule approval
- Quarterly access review
- Acceptance criteria
- Proposed: monthly cost by department reconciled within tolerance
- Proposed: documented retention period applied
- Risks
- Sensitive prompt archive
- Public-records exposure
- Cost data misread as savings
Implementation considerations
Lighthouse Advisory interpretation across the operating dimensions a public-sector buyer must settle before this evidence becomes a design. Each note answers the question under its heading for this specific source.
Architecture and integration
What must connect, and where does the AI sit in the workflow?
Multi-account log forwarding (CloudWatch Logs destination), Lambda transform, Firehose to S3 Parquet, Glue/Athena, optional CUR 2.0 join and Quick Sight dashboard; Bedrock logging must be enabled per account.
Governance
Who approves, reviews and stays accountable for outcomes?
Enables per-team accountability for AI spend; also requires a records and retention decision for stored prompts and completions.
Security and privacy
What data, permissions and controls need testing?
Concentrates full prompts and responses, which may include PII, PHI or student records, in one bucket; least-privilege access and retention limits are essential.
Accessibility and workforce
Who is affected, and what skills or accommodations follow?
No accessibility content.
Procurement
What should contracts, pricing and exit terms secure?
Supports chargeback and model-right-sizing decisions; no cost figures given.
Operating model
Which teams own the service once it runs?
Requires a FinOps or platform owner and a data owner for the prompt archive.
Publication history
- 2026-11-10AWS · Issue 128 resources
Stable resource ID: aws-bedrock-tokenomics-invocation-data-lake-20261110