Connecting AWS Bedrock

Bedrock is set up a little differently than the others. Instead of pasting in an existing key, TokenFront walks you through creating a dedicated, read-only AWS credential just for this connection. You don't need to touch IAM policies by hand.

Step 1: Create the AWS credentials

1. Open Connect AWS Bedrock in TokenFront.
2. Pick your AWS region from the dropdown.
3. Click Launch stack in the AWS console. This opens AWS CloudFormation in a new tab, pre-filled with everything needed.
4. Review the stack (it's named TokenFront-Bedrock-Access) and click Create stack.
5. Wait about 30 seconds for AWS to finish creating it.

This creates a new, narrowly-scoped IAM user with exactly the read permissions TokenFront needs to pull Bedrock usage and cost data, nothing more. It does not give TokenFront the ability to run models or change anything in your AWS account. Reading that data does carry a small AWS charge; see What syncing costs you on AWS.

If you're running TokenFront locally rather than through the hosted app, you'll instead see a Download CloudFormation Template button. In that case: go to CloudFormation in your AWS Console, choose Create stack, then Upload a template file, select the downloaded file, name the stack TokenFront-Bedrock-Access, and click through to Create stack.

Step 2: Copy the credentials into TokenFront

1. Once the stack finishes, open its Outputs tab in the AWS Console.
2. Copy the AccessKeyId value and paste it into TokenFront's Access Key ID field.
3. Copy the SecretAccessKey value and paste it into the Secret Access Key field.
4. Confirm the region matches what you selected in Step 1.
5. Save.

The first sync takes 30–90 seconds. After that, TokenFront checks in periodically on its own.

What syncing costs you on AWS

AWS charges for two of the APIs TokenFront reads. Both are billed by AWS to your account, not by TokenFront:

• Cost Explorer (Bedrock dollars): $0.01 per request, AWS's published price as of October 2026. A routine sync makes one request. The first sync and a once-a-month re-check of the previous month can make a few more.
• CloudWatch (Bedrock token counts): GetMetricData is billed per metric requested and isn't covered by CloudWatch's free tier. Each sync asks for three metrics per model, so this is usually a few cents a month.

Syncs run automatically several times a day (about 5 on a typical day), and also when you press Sync now or Test connection, or open the dashboard after the data has gone stale. At that rate, expect roughly $1.50 to $2 a month per connected region, plus a little more for manual syncs. AWS can change its prices, and your AWS bill is the authoritative figure. TokenFront's plans don't include or reimburse these charges. To stop them, pause or delete the connection, or delete the TokenFront-Bedrock-Access stack.

If the connection shows "Key rejected"

Confirm the CloudFormation stack finished creating successfully (check the AWS Console for its status) and that you copied both values from the Outputs tab exactly, with no extra spaces.

More about AWS Bedrock in TokenFront

What TokenFront shows for AWS Bedrock, and how it fits with your other providers: AWS Bedrock on tokenfront.io.