wehub-resource-sync
122 lines
4.9 KiB
Markdown
122 lines
4.9 KiB
Markdown
---
|
|
summary: "AWS Bedrock provider: Cost Explorer spend, CloudWatch Claude activity, credentials, and budgets."
|
|
read_when:
|
|
- Setting up AWS Bedrock usage tracking
|
|
- Debugging Bedrock Cost Explorer or CloudWatch fetches
|
|
- Updating Bedrock credentials, region, budget, or activity handling
|
|
---
|
|
|
|
# AWS Bedrock provider
|
|
|
|
CodexBar reads AWS Cost Explorer for Bedrock spend and can compare the current month against an optional budget. When
|
|
permitted, it also reads CloudWatch for rolling 14-day Claude token and request totals in the configured region.
|
|
|
|
## Authentication
|
|
|
|
CodexBar supports two authentication modes, selected in Preferences → Providers → AWS Bedrock → Authentication.
|
|
|
|
### Access keys (default)
|
|
|
|
Provide static AWS credentials through Settings or the environment inherited by CodexBar/the CLI:
|
|
|
|
```bash
|
|
export AWS_ACCESS_KEY_ID="..."
|
|
export AWS_SECRET_ACCESS_KEY="..."
|
|
export AWS_REGION="us-east-1"
|
|
```
|
|
|
|
Optional:
|
|
|
|
```bash
|
|
export AWS_SESSION_TOKEN="..."
|
|
export CODEXBAR_BEDROCK_BUDGET="250"
|
|
```
|
|
|
|
### AWS profile
|
|
|
|
Resolve credentials from a named profile in `~/.aws/config` / `~/.aws/credentials` instead of pasting keys. Set the
|
|
profile name in Settings (or via `AWS_PROFILE`). CodexBar shells out to the AWS CLI
|
|
(`aws configure export-credentials --profile <name>`), so this works with **SSO**, **assume-role**,
|
|
`credential_process`, and MFA-cached profiles — not just static credentials.
|
|
|
|
Requirements:
|
|
|
|
- AWS CLI v2 on your `PATH` (CodexBar also checks `/opt/homebrew/bin/aws`, `/usr/local/bin/aws`, and `~/.local/bin/aws`).
|
|
Override the location with `AWS_CLI_PATH` if it lives elsewhere.
|
|
- For SSO profiles, an active session (`aws sso login --profile <name>`). Credentials are resolved fresh on each
|
|
refresh; the AWS CLI caches the SSO token, so this does not re-prompt unless the session has expired.
|
|
|
|
The profile's region is read automatically (`aws configure get region`); leave the Region field blank to use it, or set
|
|
`AWS_REGION` / the Region field to override.
|
|
|
|
Relevant environment variables:
|
|
|
|
```bash
|
|
export CODEXBAR_BEDROCK_AUTH_MODE="profile" # set automatically by Settings; "keys" or "profile"
|
|
export AWS_PROFILE="work"
|
|
export AWS_CLI_PATH="/opt/homebrew/bin/aws" # optional override
|
|
```
|
|
|
|
The AWS identity (from either mode) must have permission to call Cost Explorer APIs, including `ce:GetCostAndUsage`.
|
|
Grant `cloudwatch:GetMetricData` to add the optional Claude activity totals. Without that permission, cost and budget
|
|
tracking continue unchanged.
|
|
|
|
## Data source
|
|
|
|
- Service: AWS Cost Explorer.
|
|
- Region: `AWS_REGION` or `AWS_DEFAULT_REGION`, defaulting to `us-east-1`.
|
|
- Usage: current-month Bedrock spend and historical daily cost buckets.
|
|
- Claude activity: rolling 14-day input tokens, output tokens, and requests from the configured region's `AWS/Bedrock`
|
|
CloudWatch metrics. Other model families are excluded.
|
|
- Budget: `CODEXBAR_BEDROCK_BUDGET`, when set to a positive dollar amount.
|
|
- Test override: `CODEXBAR_BEDROCK_API_URL` replaces the Cost Explorer endpoint; use HTTPS or loopback HTTP.
|
|
- Test override: `CODEXBAR_BEDROCK_CLOUDWATCH_API_URL` replaces the CloudWatch endpoint; use HTTPS or loopback HTTP.
|
|
|
|
## Display
|
|
|
|
- Shows month-to-date Bedrock spend.
|
|
- Shows budget progress when a budget is configured.
|
|
- Shows rolling 14-day Claude tokens and requests when CloudWatch access is available.
|
|
- Reuses the shared inline dashboard for daily cost history when enough buckets are available.
|
|
|
|
## CLI
|
|
|
|
```bash
|
|
codexbar --provider bedrock --source api
|
|
codexbar --provider bedrock --format json --pretty
|
|
```
|
|
|
|
## Troubleshooting
|
|
|
|
### "No AWS Bedrock cost data available"
|
|
|
|
- Confirm the credentials are visible to CodexBar.
|
|
- Confirm the AWS account has Cost Explorer enabled.
|
|
- Confirm the IAM principal can call `ce:GetCostAndUsage`.
|
|
- To include Claude token/request totals, confirm the principal can call `cloudwatch:GetMetricData` in the configured
|
|
region.
|
|
- If using temporary credentials, include `AWS_SESSION_TOKEN`.
|
|
- In profile mode, confirm the AWS CLI is installed (or set `AWS_CLI_PATH`) and that the profile name is correct.
|
|
|
|
### "AWS profile session expired"
|
|
|
|
The profile's SSO/temporary session has expired. Run `aws sso login --profile <name>` (or refresh the underlying
|
|
credentials) and retry.
|
|
|
|
### "AWS CLI not found"
|
|
|
|
Profile mode requires AWS CLI v2. Install it (e.g. `brew install awscli`) or point CodexBar at the binary with
|
|
`AWS_CLI_PATH`.
|
|
|
|
### Wrong region
|
|
|
|
Set `AWS_REGION` or `AWS_DEFAULT_REGION`. Bedrock usage is regional, but Cost Explorer itself is account-level; CodexBar still needs a signing region for the request.
|
|
|
|
## Key files
|
|
|
|
- `Sources/CodexBarCore/Providers/Bedrock/BedrockProviderDescriptor.swift`
|
|
- `Sources/CodexBarCore/Providers/Bedrock/BedrockSettingsReader.swift`
|
|
- `Sources/CodexBarCore/Providers/Bedrock/BedrockProfileCredentialProvider.swift`
|
|
- `Sources/CodexBarCore/Providers/Bedrock/BedrockUsageStats.swift`
|
|
- `Sources/CodexBarCore/Providers/Bedrock/BedrockAWSSigner.swift`
|