Skip to main content

Bring Your Own AI

Infracost Fix agents use Anthropic Claude models. By default those calls run through Amazon Bedrock in Infracost's AWS account. With Bring your own AI, they run through Bedrock in your account instead, so:

  • Data stays in your account: Prompts and model responses go to Bedrock in your AWS account where your guardrails and logging apply (also means you pay for the usage).
  • Simpler AI security reviews: The models run in your cloud account under your controls. Many security teams can approve this without a separate review of a third-party AI service.
note

This feature is part of Infracost Enterprise, email support@infracost.io to set it up. If you don't use Bedrock, let us know which service/gateway you use.

How it works​

Infracost uses a dedicated infracost-bedrock role in your account to call Claude models. Currently only Anthropic Claude models are supported, and your Bedrock region must support them. The role is separate from the read-only AWS integration role. It is only created if you opt-in and provides two types of access:

  • Call Anthropic Claude models (bedrock:InvokeModel and bedrock:InvokeModelWithResponseStream)
  • Check model availability and inference profiles, so setup problems can be clearly reported

Setup​

  1. In your Terraform AWS integration, enable the Bedrock option on the module for the account where model calls should run:

    module "infracost_management_account" {
      source  = "infracost/integration/aws"
      version = "0.4.0" # or later

      infracost_external_id = "YOUR_EXTERNAL_ID"
      is_management_account = true
      enable_bedrock_invoke = true
    }

  2. In a region that supports Claude cross-region inference, enable access to the Anthropic Claude models under Model access in the Bedrock console.

  3. Check that your Bedrock quotas have enough capacity for the Claude models. Agent investigations make ongoing model calls. Low quotas will cause investigations to fail or run slowly.

  4. Contact support@infracost.io with the module's bedrock_role_arn output, and we'll enable it for your organization.