Skip to main content
idle · aws

Bedrock Provisioned Throughput Idle

rule IDs covered
1
severity
high

What does ZopNight detect here?

Idle Bedrock Provisioned Throughput shows up as an absent Invocations series over the 30-day lookback, since AWS emits the count metric only when invocations occur. ZopNight treats the missing series as authoritative zero activity, abstains for any committed-term PT, and books the full monthly cost (MU-hour rate times 730) as savings.

Signal and threshold

How ZopNight evaluates Bedrock Provisioned Throughput Idle.
Field Value
Rule IDsRC-1601
Categoryidle
Severityhigh
Metricnone — pure configuration read
Sourcebedrock_pt_idle.go

When a missing invocations series means idle

  • resource.Type: bedrock-pt
  • MetricsAware: Invocations over 30 days. ABSENT-SERIES-IS-THE-IDLE-SIGNAL: AWS/Bedrock Invocations is a Sum-stat COUNT metric: a series exists only when invocations>0, so a fully-idle PT yields a missing key. On a non-nil, non-empty metrics map the rule treats an absent series for this UID as the authoritative zero-activity signal for the confirmed-present resource, and abstains only when the series is present and shows activity (bedrockMetricHasActivity). The rule hard-abstains whenever len(r.metrics)==0; this covers both r.metrics==nil (subsystem unwired) AND a non-nil-but-empty map, which is what a total per-org metrics fetch failure produces on the chunked path (service.go fetchMetricsForUIDs: on a GetResourceMetricsForUIDs error it still builds an entry from whatever partial list the client accumulated, which can be empty). Without this guard a full-org fetch outage would read as “every Bedrock PT is idle” and mass-fire delete recs. Residual gap (requires an aggregator producer change, not fixable in this rule): a partial fetch failure that drops only this PT’s series while the rest of the org’s metrics map is populated is still indistinguishable from genuine idle; closing it needs the aggregator to emit an explicit zero-datapoint marker row (or a per-resource fetch-success signal) for a discovered bedrock-pt whose CloudWatch fetch completed with no series.
  • resource.Metadata: commitmentDuration (OneMonth/SixMonths; producer bedrock.go:580-581, omitted when empty); the rule abstains for any non-empty commitment term, because a committed PT cannot be torn down before term-end and bills regardless.

The 30-day idle window

Terminal window
bedrockPTLookbackDays=30 (the hardcoded bedrockPTIdleSavingsFraction=1.00 literal was REMOVED)

Why a no-commitment idle PT recovers its full cost

PricingAware uses per-resource monthly cost (the provisioned model-unit hourly rate × 730) from Aggregator; a no-commitment idle PT is freely deletable, so savings are set directly to the full current cost (savings_mechanism=full_recovered_cost, not a fraction). Skips when pricing missing (per pricing-aggregator-only invariant).

Deleting the PT once traffic has moved

  1. Confirm no production traffic targets this PT
  2. Migrate the workload to on-demand inference if usage is sporadic
  3. Delete the PT via the Bedrock console once traffic is migrated
  4. If PT is required for guaranteed capacity, document the SLA driving it

Invocations keyed by model ID

Invocations (30-day lookback, AWS/Bedrock namespace, dim ModelId)

See it fire on your bill.

Connect an account read-only. The first findings land in minutes.

417 rule families across 353 resource types on 22 platforms. Every threshold, metric, and IAM action is documented on these pages before you grant anything.

417 rule families documented
353 resource types covered
read-only default access level
Multi-cloud automation· Production-ready in 30 min· SOC 2 · ISO 27001· 20–60% off the bill, first month· 4 platforms · 1 console· Multi-cloud automation· Production-ready in 30 min· SOC 2 · ISO 27001· 20–60% off the bill, first month· 4 platforms · 1 console·