import os import boto3 bedrock = boto3.client( "bedrock-runtime", region_name="us-east-1", endpoint_url="https://gateway.palmsouqltd.com/bedrock/us-east-1", ) def palmsouq_headers(request, **kwargs): request.headers["X-PalmSouq-Key"] = os.environ["PALMSOUQ_KEY"] request.headers["X-PalmSouq-Tenant"] = current_tenant().id request.headers["X-PalmSouq-Tier"] = current_tenant().plan bedrock.meta.events.register("before-send.bedrock-runtime.*", palmsouq_headers) resp = bedrock.converse( modelId="amazon.nova-pro-v1:0", messages=[{"role": "user", "content": [{"text": "Draft a renewal email"}]}], )

How Bedrock traffic reaches the gateway

Bedrock requests are signed with AWS Signature Version 4, and a SigV4 signature is bound to the host it was signed for. So instead of forwarding your signature, PALM SOUQ assumes an IAM role in your AWS account using an external ID, and signs the upstream call to bedrock-runtime itself. The role needs bedrock:InvokeModel and bedrock:InvokeModelWithResponseStream on the model ARNs you choose, and nothing else.

Your application points the boto3 bedrock-runtime client at gateway.palmsouqltd.com/bedrock with the region in the path, and adds the PALM SOUQ key and tenant headers with a botocore event hook. The Converse and ConverseStream APIs are supported, as are InvokeModel calls with provider-native bodies.

Metering on Bedrock

The Converse API returns a usage object with inputTokens, outputTokens and, for models that support prompt caching on Bedrock, cacheReadInputTokens and cacheWriteInputTokens. PALM SOUQ prices each against the Bedrock rate for that model and region. Bedrock list prices can differ from the model maker's own API, so the gateway keeps a separate Bedrock price table rather than reusing Anthropic or Meta direct prices.

If you buy Provisioned Throughput, per-token cost is not the right number for margin. In that case PALM SOUQ allocates the hourly commitment across tenants in proportion to the tokens each one consumed in the hour, which gives finance a defensible cost per customer even on reserved capacity.

Why teams govern Bedrock separately

AWS budgets and Cost Explorer show Bedrock spend per account, per region and per tag, but not per end customer of your SaaS. Cost allocation tags work on resources, and a model invocation from a shared application role carries no customer identity. PALM SOUQ adds that identity at the request level.

Breakers matter on Bedrock for the same reason they matter anywhere: an agent loop on Claude Sonnet through Bedrock costs the same per token as one through the Anthropic API. The four loop heuristics run on Converse tool use blocks exactly as they do on native Anthropic traffic.

Rolling it out safely

Create the IAM role with the narrowest policy you can: InvokeModel and InvokeModelWithResponseStream on the specific model ARNs, an external ID unique to your PALM SOUQ organisation, and a trust policy that names the PALM SOUQ account. CloudTrail will then show every invocation the gateway makes on your behalf.

Test in one region first. Once Converse traffic in us-east-1 matches Cost Explorer for a day, add other regions by registering their endpoints; the role and the tenant headers stay the same.

PALM SOUQ for AWS Bedrock

How Bedrock traffic reaches the gateway

Metering on Bedrock

Why teams govern Bedrock separately

Rolling it out safely

Govern AWS Bedrock usage per tenant, starting today.