Bedrock Marketplace endpoints billing instance-hours with no observed traffic
What does ZopNight detect here?
Marketplace model endpoints are SageMaker instances under a Bedrock label, billed per instance-hour around the clock, unlike token-billed Bedrock models. ZopNight requires a present Invocations series showing 30 days of zero traffic plus a positive measured cost, and today that join cannot be satisfied, so the rule abstains on every endpoint.
Signal and threshold
| Field | Value |
|---|---|
| Rule IDs | RC-1632 |
| Category | idle |
| Severity | high |
| Metric | none — pure configuration read |
| Source | bedrock_marketplace_endpoint_idle.go |
Where it applies
The one Bedrock resource that bills like a server
Most Bedrock offerings are serverless: tokens in, dollars out, nothing idles. A Marketplace model deployment is the exception: behind the Bedrock ARN sits a real SageMaker endpoint on provisioned ML instances, billing at its ML instance rate every hour whether or not a single request arrives. An idle one is pure waste in the classic sense, and deletion recovers the full instance cost, which is why this rule prices its saving at 100% of the measured monthly spend.
Why this rule demands stricter evidence than its siblings
For Bedrock-native metrics, an absent series is proof of zero traffic. Not here. The traffic signal lives in the SageMaker metric namespace, dimensioned by endpoint name and variant name, and the variant is not derivable from the Bedrock-side discovery data. The series is therefore absent for busy and idle endpoints alike, and treating absence as idleness would fire an unconditional delete on every priced endpoint in the fleet. So the rule inverts its siblings’ logic: only a present series showing zero activity, together with a positive cost, fires.
The honest consequence: it abstains everywhere today
Because the metrics join can never currently populate that series, this rule abstains on every marketplace endpoint as wired now. That is a deliberate fail-safe, not an oversight. The alternative was mass-firing destructive recommendations on no evidence. Until the variant dimension reaches the metrics pipeline, treat this page as documentation of the check’s design plus a manual procedure you can run yourself.
The manual version of the check
aws cloudwatch get-metric-statistics \ --namespace AWS/SageMaker --metric-name Invocations \ --dimensions Name=EndpointName,Value=<endpoint-name> Name=VariantName,Value=AllTraffic \ --start-time "$(date -u -v-30d +%Y-%m-%dT%H:%M:%SZ)" \ --end-time "$(date -u +%Y-%m-%dT%H:%M:%SZ)" \ --period 86400 --statistics SumThirty days of zeros on an endpoint you are paying for is the condition this rule exists to catch.
If you find one
Confirm no application targets the endpoint, note the model package so redeployment stays a one-step operation, then delete the deployment from the Bedrock console. The SageMaker instances behind it stop billing at teardown. An endpoint kept “just in case” deserves a documented SLA justifying its always-on cost, because per-hour pricing never pauses on its own.