Amazon Bedrock

To view AI usage information for Amazon Bedrock in 1Password SaaS Manager, an AWS administrator must create a designated IAM role with a read-only permissions policy attached so SaaS Manager can start recording information.

Requirements

The IAM user associated with the role you create must have the following permissions, which are generally granted to an administrative-level user in an AWS account:

  • iam:ListUsers: Allows SaaS Manager to see users that may appear in Bedrock usage data.
  • iam:ListRoles: Allows SaaS Manager to see IAM roles and service account-like actors that may appear in Bedrock usage data.
  • cloudtrail:LookupEvents: Allows SaaS Manager to read Bedrock runtime events to determine model, caller identity, request count, input tokens, and output tokens.
  • ce:GetCostAndUsage: Allows SaaS Manager to see app and account-level Bedrock spend and billing data from AWS Cost Explorer.
  • ce:GetDimensionValues: Allows SaaS Manager to read AWS Cost Explorer dimension labels for specific date ranges in the account.

Step 1: Create the permissions policy

To create the permissions policy, follow these steps to create a policy in AWS, then copy and paste the following policy in the JSON editor:

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": [
        "iam:ListUsers",
        "iam:ListRoles",
        "cloudtrail:LookupEvents",
        "ce:GetCostAndUsage",
        "ce:GetDimensionValues"
      ],
      "Resource": "*"
    }
  ]
}

Name the policy SaasManagerIntegrationBedrockPolicy. When you finish following the instructions, select Create policy.

Step 2: Create the IAM role

To create the IAM role to attach the permissions policy to, follow these steps to create the role.

Refer to these additional details as you create the role:

  • At step 4, select Another AWS account, then copy and paste 377450845233 into the Account ID field.

  • At step 5, select Require external ID, then paste your SaaS Manager organization ID. To find this value, sign in to SaaS Manager, then select your profile icon in the top-right corner. Select Profile, then copy your Organization ID at the bottom of the page.

  • At step 8, search for the SaasManagerIntegrationBedrockPolicy policy you created in step 1.

  • At step 11, enter SaasManagerBedrockIntegration as the role name. You must use this exact name for the integration to work properly.

  • After creation, verify that the SaasManagerBedrockIntegration > Trust Policy has the action that allows role assumption. You will end up with a config that has Effect and Action like this.

    {
    "Version": "2012-10-17",
    "Statement": [
        {
            "Effect": "Allow",
            "Action": "sts:AssumeRole",
            "Principal": {
                "AWS": "377450845233"
            },
            "Condition": {
                "StringEquals": {
                    "sts:ExternalId": "<your Organization ID>"
                }
            }
        }
    ]
}

Step 3: Connect the IAM role to SaaS Manager

To connect the IAM role you created to SaaS Manager, follow these steps:

  1. Sign into SaaS Manager and navigate to Integrations > Amazon Bedrock.
  2. Select Connect, then paste the AWS account ID associated with the account that has the role you created.
  3. Turn on AI Consumption and select your Bedrock runtime region, then select Connect.

Published: