Bedrock agents no workload has invoked in 30 days

Why an idle agent carries a $0 price tag

A Bedrock agent is orchestration config: instructions, action groups, a pointer at a foundation model. AWS charges nothing for the object itself; every dollar lands on the model side of Bedrock’s price list, as provisioned throughput or on-demand token spend. So when this rule finds an agent nobody invokes, it deliberately claims no savings. The recoverable money is already tracked against the PT and custom-model resources the agent sits on, and counting it here too would book the same dollars twice. The finding is filed as advisory: the value is the cleanup prompt, not a number.

The InvokeAgent traffic gate

The idle test reads an Invocations series with a 30-day lookback, one of the counters Bedrock reports to CloudWatch, and the activity check runs on the full fetched history rather than the trimmed window. An agent that answered requests 45 days ago and has been quiet since does not qualify. Trimming first would manufacture a false delete prompt for anything recently paused. Any datapoint above zero, or a positive average or maximum on the series, ends the evaluation with no finding.

A dimension mismatch keeps this rule quiet today

The pipeline requests Invocations from the AWS/Bedrock namespace dimensioned by AgentId. Bedrock agent runtime metrics actually live in AWS/Bedrock/Agents as InvocationCount, dimensioned by Operation (optionally with AgentAliasArn and ModelId), and no AgentId dimension exists. That query can never return a datapoint for any agent, busy or abandoned, so an absent series here proves nothing about idleness. The rule fails closed and abstains on absence, which means it currently reports nothing at all. That stays true until discovery captures each agent’s alias ARNs and the collector is repointed at the real namespace. That is a producer-side fix, stated here so the silence is not mistaken for a healthy fleet.

Listing agents and their real metrics

aws bedrock-agent list-agents \
  --query 'agentSummaries[].{id:agentId,name:agentName,status:agentStatus}'
aws cloudwatch list-metrics --namespace AWS/Bedrock/Agents --metric-name InvocationCount

The second command shows which dimension combinations CloudWatch actually holds for your agents, which is useful for judging traffic manually while the automated path is dark.

Retiring an agent cleanly

Confirm no production workload calls the agent, then note which PT, custom model or knowledge base it references before deleting it in the Bedrock console. Those downstream resources keep billing on their own; decommission any that have no other consumer.