Real-Time Spend Enforcement for Amazon Bedrock: Jamf's Solution

Jamf, a company trusted by over 76,000 organizations to manage and secure Apple devices at scale, faced a unique challenge when accelerating AI-assisted development with Amazon Bedrock. The AI spend on the platform behaved unlike any traditional compute cost line before it, scaling with behavior rather than provisioned capacity.

A single engineer running an agentic coding loop against a premium model could burn more tokens in a few hours than a team did in a week, making both cost control and return on investment hard to prove. Leadership needed answers: What do we spend per person? Can we cap it without slowing the engineers down? And do the productivity gains justify the cost?

Jamf built a production system that solved this at the individual level, using AWS Identity and Access Management (IAM) Customer Managed Policies (CMPs), an Amazon Athena-based cost view, and a serverless AWS Lambda enforcement loop. The solution tracks each engineer's daily Amazon Bedrock spending, applies tiered model restrictions as they approach their budget, and enforces these restrictions in near-real-time without disrupting active sessions.