Skip to main content
idle · aws

Bedrock Marketplace endpoints billing instance-hours with no observed traffic

resource types
1
rule IDs covered
1
severity
high

What does ZopNight detect here?

Marketplace model endpoints are SageMaker instances under a Bedrock label, billed per instance-hour around the clock, unlike token-billed Bedrock models. ZopNight requires a present Invocations series showing 30 days of zero traffic plus a positive measured cost, and today that join cannot be satisfied, so the rule abstains on every endpoint.

Signal and threshold

How ZopNight evaluates Bedrock Marketplace endpoints billing instance-hours with no observed traffic.
Field Value
Rule IDsRC-1632
Categoryidle
Severityhigh
Metricnone — pure configuration read
Sourcebedrock_marketplace_endpoint_idle.go

The one Bedrock resource that bills like a server

Most Bedrock offerings are serverless: tokens in, dollars out, nothing idles. A Marketplace model deployment is the exception: behind the Bedrock ARN sits a real SageMaker endpoint on provisioned ML instances, billing at its ML instance rate every hour whether or not a single request arrives. An idle one is pure waste in the classic sense, and deletion recovers the full instance cost, which is why this rule prices its saving at 100% of the measured monthly spend.

Why this rule demands stricter evidence than its siblings

For Bedrock-native metrics, an absent series is proof of zero traffic. Not here. The traffic signal lives in the SageMaker metric namespace, dimensioned by endpoint name and variant name, and the variant is not derivable from the Bedrock-side discovery data. The series is therefore absent for busy and idle endpoints alike, and treating absence as idleness would fire an unconditional delete on every priced endpoint in the fleet. So the rule inverts its siblings’ logic: only a present series showing zero activity, together with a positive cost, fires.

The honest consequence: it abstains everywhere today

Because the metrics join can never currently populate that series, this rule abstains on every marketplace endpoint as wired now. That is a deliberate fail-safe, not an oversight. The alternative was mass-firing destructive recommendations on no evidence. Until the variant dimension reaches the metrics pipeline, treat this page as documentation of the check’s design plus a manual procedure you can run yourself.

The manual version of the check

Terminal window
aws cloudwatch get-metric-statistics \
--namespace AWS/SageMaker --metric-name Invocations \
--dimensions Name=EndpointName,Value=<endpoint-name> Name=VariantName,Value=AllTraffic \
--start-time "$(date -u -v-30d +%Y-%m-%dT%H:%M:%SZ)" \
--end-time "$(date -u +%Y-%m-%dT%H:%M:%SZ)" \
--period 86400 --statistics Sum

Thirty days of zeros on an endpoint you are paying for is the condition this rule exists to catch.

If you find one

Confirm no application targets the endpoint, note the model package so redeployment stays a one-step operation, then delete the deployment from the Bedrock console. The SageMaker instances behind it stop billing at teardown. An endpoint kept “just in case” deserves a documented SLA justifying its always-on cost, because per-hour pricing never pauses on its own.

See it fire on your bill.

Connect an account read-only. The first findings land in minutes.

417 rule families across 353 resource types on 22 platforms. Every threshold, metric, and IAM action is documented on these pages before you grant anything.

417 rule families documented
353 resource types covered
read-only default access level
Multi-cloud automation· Production-ready in 30 min· SOC 2 · ISO 27001· 20–60% off the bill, first month· 4 platforms · 1 console· Multi-cloud automation· Production-ready in 30 min· SOC 2 · ISO 27001· 20–60% off the bill, first month· 4 platforms · 1 console·