feat(aws): add Bedrock token pricing collector (#921)

Author: simaarfania

docs/metrics/aws/bedrock.md

@@ -0,0 +1,59 @@
+# AWS Bedrock Metrics
+
+| Metric name                                               | Metric type | Description                                                   | Labels                                                                                                                                                                |
+|-----------------------------------------------------------|-------------|---------------------------------------------------------------|-----------------------------------------------------------------------------------------------------------------------------------------------------------------------|
+| `cloudcost_aws_bedrock_token_input_usd_per_1k_tokens`     | Gauge       | AWS Bedrock input token price in USD per 1000 tokens          | `account_id`=<AWS account ID> <br/> `region`=<AWS region> <br/> `model_id`=<model slug> <br/> `family`=<model provider> <br/> `price_tier`=<on_demand\|on_demand_batch\|on_demand_flex\|on_demand_priority\|cross_region> |
+| `cloudcost_aws_bedrock_token_output_usd_per_1k_tokens`    | Gauge       | AWS Bedrock output token price in USD per 1000 tokens         | `account_id`=<AWS account ID> <br/> `region`=<AWS region> <br/> `model_id`=<model slug> <br/> `family`=<model provider> <br/> `price_tier`=<on_demand\|on_demand_batch\|on_demand_flex\|on_demand_priority\|cross_region> |
+| `cloudcost_aws_bedrock_search_unit_usd_per_1k_search_units` | Gauge     | AWS Bedrock search unit price in USD per 1000 search units (e.g. Cohere Rerank) | `account_id`=<AWS account ID> <br/> `region`=<AWS region> <br/> `model_id`=<model slug> <br/> `family`=<model provider> <br/> `price_tier`=<on_demand\|cross_region> |
+
+## Overview
+
+The Bedrock collector exports list-price token cost metrics for AWS Bedrock foundation models across all configured regions. These are pricing rates, not measured spend. Multiply rates by token usage (e.g. from CloudWatch `AWS/Bedrock` metrics) to compute estimated cost.
+
+## Configuration
+
+Add `bedrock` to your AWS services configuration:
+
+```yaml
+aws:
+  services: ["bedrock"]
+  regions: ["us-east-1", "us-west-2"]
+```
+
+Or via command line:
+```bash
+--aws.services=bedrock
+```
+
+## Labels
+
+- **`account_id`**: AWS account ID (12-digit), resolved via STS `GetCallerIdentity`
+- **`region`**: AWS region for which the price applies
+- **`model_id`**: Model slug from the AWS Pricing API `usagetype` field (e.g. `Claude3Sonnet`, `Llama4-Scout-17B`, `Nova2.0Pro`)
+- **`family`**: Model provider, lowercased with spaces replaced by underscores (e.g. `anthropic`, `amazon`, `meta`, `mistral_ai`). Models with no provider attribute use `amazon`.
+- **`price_tier`**: Inference tier: `on_demand`, `on_demand_batch`, `on_demand_flex`, `on_demand_priority`, or `cross_region`
+
+## Notes
+
+- Pricing data is fetched from the AWS Pricing API (`us-east-1` endpoint) and refreshed every 24 hours
+- Image, video, audio, cache, and guardrail SKUs are skipped; only text token SKUs are emitted
+- `model_id` is the pricing SKU slug, not the canonical Bedrock model ARN
+
+## IAM Permissions
+
+Required permissions for Bedrock metrics collection:
+
+```json
+{
+    "Version": "2012-10-17",
+    "Statement": [
+        {
+            "Effect": "Allow",
+            "Action": [
+                "pricing:GetProducts"
+            ],
+            "Resource": "*"
+        }
+    ]
+}
+```

pkg/aws/aws.go

@@ -23,6 +23,7 @@ import (
 	"github.com/prometheus/client_golang/prometheus"
 	"golang.org/x/sync/errgroup"
 
+	"github.com/grafana/cloudcost-exporter/pkg/aws/bedrock"
 	"github.com/grafana/cloudcost-exporter/pkg/aws/client"
 	ec2Collector "github.com/grafana/cloudcost-exporter/pkg/aws/ec2"
 	"github.com/grafana/cloudcost-exporter/pkg/aws/elb"
@@ -87,13 +88,14 @@ const (
 	collectConcurrencyLimit = 10
 
 	// AWS service names used across the AWS provider.
-	serviceS3    = "S3"
-	serviceEC2   = "EC2"
-	serviceRDS   = "RDS"
-	serviceNATGW = "NATGATEWAY"
-	serviceELB   = "ELB"
-	serviceVPC   = "VPC"
-	serviceMSK   = "MSK"
+	serviceS3      = "S3"
+	serviceEC2     = "EC2"
+	serviceRDS     = "RDS"
+	serviceNATGW   = "NATGATEWAY"
+	serviceELB     = "ELB"
+	serviceVPC     = "VPC"
+	serviceMSK     = "MSK"
+	serviceBedrock = "BEDROCK"
 )
 
 func New(ctx context.Context, config *Config) (*AWS, error) {
@@ -256,6 +258,29 @@ func newWithDependencies(ctx context.Context, config *Config, awsClient client.C
 				continue
 			}
 			collectors = append(collectors, collector)
+		case serviceBedrock:
+			// Bedrock pricing lookups succeed regardless of the collector's configured regions.
+			// Note: this pins the *endpoint*, not the queried region — the collector still
+			// fetches prices per configured region via a regionCode filter. See
+			// pkg/aws/bedrock.go newPriceFetcher().
+			bedrockPricingConfig := awsConfig.Copy()
+			bedrockPricingConfig.Region = "us-east-1"
+			awsBedrockClient := client.NewAWSClient(client.Config{
+				PricingService: awsPricing.NewFromConfig(bedrockPricingConfig),
+			})
+			collector, err := bedrock.New(ctx, &bedrock.Config{
+				Regions:       regions,
+				PricingClient: awsBedrockClient,
+				Logger:        logger,
+				AccountID:     config.AccountID,
+			})
+			if err != nil {
+				logger.LogAttrs(ctx, slog.LevelError, "Error creating collector",
+					slog.String("service", service),
+					slog.String("message", err.Error()))
+				continue
+			}
+			collectors = append(collectors, collector)
 		default:
 			logger.LogAttrs(ctx, slog.LevelWarn, "unknown server, skipping",
 				slog.String("service", service),

pkg/aws/aws_test.go

@@ -183,6 +183,18 @@ func Test_NewWithDependencies(t *testing.T) {
 			// The collector is skipped gracefully; newWithDependencies still succeeds.
 			expectedCollectors: 0,
 		},
+		{
+			name:     "Bedrock service is skipped gracefully when pricing API unavailable",
+			services: []string{"BEDROCK"},
+			regions: []types.Region{
+				{RegionName: stringPtr("us-east-1")},
+			},
+			setupRegionClients: map[string]client.Client{},
+			// Bedrock uses its own dedicated pricing client (not the injected awsClient),
+			// so collector creation fails without real AWS credentials in tests.
+			// The collector is skipped gracefully; newWithDependencies still succeeds.
+			expectedCollectors: 0,
+		},
 	}
 
 	for _, tt := range tests {
@@ -605,8 +617,12 @@ func Test_AllCostMetricDescsIncludeAccountID(t *testing.T) {
 
 	// Create provider with all services that implement Describe.
 	// S3 and RDS return nil from Describe, so they won't contribute Descs,
-	// but EC2, ELB, NATGATEWAY, VPC, and MSK all do.
-	allServices := []string{serviceEC2, serviceELB, serviceNATGW, serviceVPC, serviceMSK}
+	// but EC2, ELB, NATGATEWAY, VPC, MSK, and Bedrock all do.
+	// Note: ELB, VPC, and NATGATEWAY call createAWSConfig which requires real credentials;
+	// Bedrock and MSK create their own pricing clients that also need credentials.
+	// Without credentials these collectors are skipped, but the test still verifies
+	// that any collector which does initialize exposes account_id on all its Descs.
+	allServices := []string{serviceEC2, serviceELB, serviceNATGW, serviceVPC, serviceMSK, serviceBedrock}
 	config := &Config{
 		Services:       allServices,
 		Region:         "us-east-1",