Skip to main content
orphan · aws

Bedrock custom models no Provisioned Throughput or active deployment references

resource types
1
rule IDs covered
1
severity
medium

What does ZopNight detect here?

ZopNight flags an Amazon Bedrock custom model that no Provisioned Throughput and no `Active` custom model deployment references. Every stored custom model carries a monthly storage fee, shown as $1.95 in AWS pricing examples, so deleting an orphaned model recovers that full charge. The finding needs complete throughput and deployment lists.

Signal and threshold

How ZopNight evaluates Bedrock custom models no Provisioned Throughput or active deployment references.
Field Value
Rule IDsRC-1604
Categoryorphan
Severitymedium
Metricnone — pure configuration read
Thresholdno Provisioned Throughput and no Active deployment
SourceZopNight
Permissions usedbedrock:ListCustomModels · bedrock:ListProvisionedModelThroughputs · bedrock:ListCustomModelDeployments

Custom models bill for storage even when nothing serves them

When you fine-tune or continue pre-training a model in Bedrock, the result is stored as a custom model in your account. The worked examples on the Amazon Bedrock pricing page include “custom model storage per month ($1.95)” as a line item in its fine-tuning scenarios. To use the model, you then set up inference either by buying Provisioned Throughput or by deploying it for on-demand inference.

Experiments leave many models behind: each training run with a different dataset or hyperparameters becomes another stored model, and only one of them ends up being served.

Matching models to what serves them

List the custom models, then the two things that can serve one, and compare the ARNs:

Terminal window
aws bedrock list-custom-models \
--query 'modelSummaries[].[modelName,modelArn]' --output table
aws bedrock list-provisioned-model-throughputs \
--query 'provisionedModelSummaries[].[provisionedModelName,modelArn,foundationModelArn]'
aws bedrock list-custom-model-deployments \
--query 'modelDeploymentSummaries[].[customModelDeploymentName,modelArn,status]'

A custom model ARN that appears in neither list is serving nothing.

How ZopNight decides a model is orphaned

ZopNight builds the same cross-reference. A model counts as in use if any Provisioned Throughput points at it, or if a custom model deployment for it is Active. A deployment that is still being created or has failed is not serving inference, so it does not protect the model. When neither applies, the model is flagged, provided it has a monthly storage price.

Why a model might not be flagged

If either list call failed during discovery, the cross-reference is incomplete. A positive match found anyway still counts, but a model is never marked unused from partial data; it waits for a full pass. A model with no storage price in ZopNight’s data is skipped rather than shown at $0.

One storage fee per model

Terminal window
saving = custom model storage fee per month
cost after fix = 0

The saving per model is small; it adds up in accounts that fine-tune often.

Cleaning up unused custom models

  1. Confirm with the ML team that no upcoming launch or evaluation needs the model.
  2. Keep the training data and job configuration so the model can be rebuilt if needed.
  3. Delete it with aws bedrock delete-custom-model --model-identifier and the model ARN.
  4. Add a cleanup step to fine-tuning pipelines so losing candidates are deleted after evaluation.

See it fire on your bill.

Connect an account read-only. The first findings land in minutes.

472 rule families across 353 resource types on 22 platforms. Every threshold, metric, and IAM action is documented on these pages before you grant anything.

472 rule families documented
353 resource types covered
read-only default access level
Multi-cloud automation· Production-ready in 30 min· SOC 2 · ISO 27001· 20–60% off the bill, first month· 4 platforms · 1 console· Multi-cloud automation· Production-ready in 30 min· SOC 2 · ISO 27001· 20–60% off the bill, first month· 4 platforms · 1 console·