通过 LiteLLM 实现 Amazon Bedrock 成本管控：实时限额、多维监控与平台级兜底

┌─────────────────────────────────────────────────────────────────────┐
│                     多层纵深防御体系                                   │
├─────────────────────────────────────────────────────────────────────┤
│                                                                     │
│  ┌──────────┐    ┌──────────────┐    ┌────────────────────────┐    │
│  │ 开发者    │───→│ LiteLLM Proxy │───→│ Amazon Bedrock         │    │
│  │ 应用服务  │    │              │    │ (VPC Endpoint 内网访问)  │    │
│  └──────────┘    │ • Virtual Key │    └────────────────────────┘    │
│                  │ • Tag 花费追踪 │                                  │
│                  │ • Rate Limit  │    ┌────────────────────────┐    │
│                  │ • Budget 限额  │───→│ PostgreSQL             │    │
│                  └──────────────┘    │ (花费 & 审计记录)        │    │
│                                      └────────────────────────┘    │
│                                                                     │
│  ┌───────────────────────────────────────────────────────────────┐ │
│  │              AWS 原生安全与兜底层                                │ │
│  │                                                               │ │
│  │  成本兜底：AWS Budgets + Budget Action → 自动 Deny          │ │
│  │  网络层：VPC Endpoint + Source VPC 限制 + Security Group    │ │
│  │  身份层：IAM 最小权限 + Key 分离 + Secrets Manager          │ │
│  │  检测层：CloudTrail + GuardDuty + CloudWatch 异常检测       │ │
│  └───────────────────────────────────────────────────────────────┘ │
│                                                                     │
└─────────────────────────────────────────────────────────────────────┘

curl -X POST 'http://***litellm-gateway***.com/key/generate' \
  -H 'Authorization: Bearer sk-1234' \
  -H 'Content-Type: application/json' \
  -d '{
    "models": ["bedrock-claude-opus-4-6", "bedrock-claude-opus-4-7"],
    "key_alias": "game1-qa",
    "max_budget": 50,
    "budget_duration": "1mo",
    "tpm_limit": 100000,
    "rpm_limit": 60,
    "metadata": {"tags": ["team:qa", "project:game1"]}
  }'

# 游戏 QA 团队
curl -X POST 'http://localhost:4000/key/generate' \
  -H 'Authorization: Bearer sk-1234' \
  -d '{
    "models": ["bedrock-claude-opus-4-6", "bedrock-claude-opus-4-7"],
    "key_alias": "game1-qa",
    "metadata": {"tags": ["team:qa", "project:game1"]},
    "max_budget": 50
  }'

# 生产服务
curl -X POST 'http://localhost:4000/key/generate' \
  -H 'Authorization: Bearer sk-1234' \
  -d '{
    "models": ["bedrock-claude-opus-4-7"],
    "key_alias": "prod-service",
    "metadata": {"tags": ["team:prod", "env:production"]},
    "max_budget": 200
  }'

model_list:
  - model_name: claude-opus
    litellm_params:
      model: bedrock/us.anthropic.claude-opus-4-6-v1
      tags: ["tier:standard"]
  - model_name: claude-opus
    litellm_params:
      model: bedrock/us.anthropic.claude-opus-4-7
      tags: ["tier:premium"]

router_settings:
  enable_tag_filtering: true

Bedrock 服务产生花费
       ↓
AWS Billing 按服务汇总花费（有 4-8h 延迟）
       ↓
AWS Budgets 持续检查：Bedrock 服务花费 vs 预算阈值
       ↓
├── 达到 80% → 发送告警邮件
└── 达到 100% → 触发 Budget Action
                        ↓
              自动给用户附加 Deny Policy
                        ↓
              用户再调用 Bedrock → 被拒绝（403）
                        ↓
              下个月初自动移除 Deny Policy → 恢复访问

aws iam create-policy \
  --policy-name "DenyBedrockAccess" \
  --policy-document '{
    "Version": "2012-10-17",
    "Statement": [{
      "Effect": "Deny",
      "Action": [
        "bedrock:InvokeModel",
        "bedrock:InvokeModelWithResponseStream",
        "bedrock:Converse",
        "bedrock:ConverseStream"
      ],
      "Resource": "*"
    }]
  }'

aws iam create-role \
  --role-name "BudgetActionRole" \
  --assume-role-policy-document '{
    "Version": "2012-10-17",
    "Statement": [{
      "Effect": "Allow",
      "Principal": {"Service": "budgets.amazonaws.com"},
      "Action": "sts:AssumeRole"
    }]
  }'

aws iam put-role-policy \
  --role-name "BudgetActionRole" \
  --policy-name "BudgetActionPermissions" \
  --policy-document '{
    "Version": "2012-10-17",
    "Statement": [{
      "Effect": "Allow",
      "Action": ["iam:AttachUserPolicy", "iam:DetachUserPolicy"],
      "Resource": "arn:aws:iam::<YOUR_ACCOUNT_ID>:user/brclient"
    }]
  }'

aws budgets create-budget \
  --account-id <YOUR_ACCOUNT_ID> \
  --budget '{
    "BudgetName": "Bedrock-Monthly-Budget",
    "BudgetLimit": {"Amount": "10", "Unit": "USD"},
    "TimeUnit": "MONTHLY",
    "BudgetType": "COST",
    "CostFilters": {"Service": ["Amazon Bedrock"]}
  }' \
  --notifications-with-subscribers '[
    {"Notification": {"NotificationType": "ACTUAL", "ComparisonOperator": "GREATER_THAN", "Threshold": 80, "ThresholdType": "PERCENTAGE"},
     "Subscribers": [{"SubscriptionType": "EMAIL", "Address": "<YOUR_EMAIL>"}]},
    {"Notification": {"NotificationType": "ACTUAL", "ComparisonOperator": "GREATER_THAN", "Threshold": 100, "ThresholdType": "PERCENTAGE"},
     "Subscribers": [{"SubscriptionType": "EMAIL", "Address": "<YOUR_EMAIL>"}]}
  ]' --region us-east-1

aws budgets create-budget-action \
  --account-id <YOUR_ACCOUNT_ID> \
  --budget-name "Bedrock-Monthly-Budget" \
  --notification-type ACTUAL \
  --action-type APPLY_IAM_POLICY \
  --action-threshold '{"ActionThresholdValue": 100, "ActionThresholdType": "PERCENTAGE"}' \
  --definition '{"IamActionDefinition": {"PolicyArn": "arn:aws:iam::<YOUR_ACCOUNT_ID>:policy/DenyBedrockAccess", "Users": ["brclient"]}}' \
  --execution-role-arn "arn:aws:iam::<YOUR_ACCOUNT_ID>:role/BudgetActionRole" \
  --approval-model AUTOMATIC \
  --subscribers '[{"SubscriptionType": "EMAIL", "Address": "<YOUR_EMAIL>"}]' \
  --region us-east-1

{
  "error": true,
  "message": "User: arn:aws:iam::****:user/brclient is not authorized to perform: bedrock:InvokeModelWithResponseStream ... with an explicit deny in an identity-based policy: arn:aws:iam::****:policy/DenyBedrockAccess"
}

{
  "Version": "2012-10-17",
  "Statement": [{
    "Effect": "Deny",
    "Action": "bedrock:*",
    "Resource": "*",
    "Condition": {
      "StringNotEquals": {"aws:SourceVpc": "vpc-xxxxxxxx"}
    }
  }]
}

Bedrock API 调用
       ↓
CloudTrail 记录每次 InvokeModel 事件（含模型 ID、用户、时间）
       ↓
日志存储到 S3
       ↓
Athena 建表（结构化查询层）
       ↓
┌─────────────────────────────────────────────────┐
│  SQL 分析：Athena 直接查询                        │
│  自然语言分析：Amazon Quick（自然语言查询）   │
│  （两者结合，技术人员用 SQL，管理层用自然语言提问） │
└─────────────────────────────────────────────────┘

CREATE EXTERNAL TABLE cloudtrail_bedrock_logs (
  eventTime STRING,
  eventSource STRING,
  eventName STRING,
  userIdentity STRUCT<
    type: STRING,
    arn: STRING,
    accountId: STRING,
    userName: STRING
  >,
  requestParameters STRING,
  responseElements STRING,
  sourceIPAddress STRING,
  userAgent STRING
)
ROW FORMAT SERDE 'org.apache.hive.hcatalog.data.JsonSerDe'
LOCATION 's3://<YOUR_CLOUDTRAIL_BUCKET>/AWSLogs/<ACCOUNT_ID>/CloudTrail/';

SELECT
  userIdentity.userName AS user_name,
  eventName,
  COUNT(*) AS call_count,
  DATE(from_iso8601_timestamp(eventTime)) AS call_date
FROM cloudtrail_bedrock_logs
WHERE eventSource = 'bedrock.amazonaws.com'
  AND eventName IN ('InvokeModel', 'InvokeModelWithResponseStream', 'Converse', 'ConverseStream')
GROUP BY userIdentity.userName, eventName, DATE(from_iso8601_timestamp(eventTime))
ORDER BY call_count DESC;

SELECT
  json_extract_scalar(requestParameters, '$.modelId') AS model_id,
  COUNT(*) AS invocation_count,
  COUNT(DISTINCT userIdentity.userName) AS unique_users
FROM cloudtrail_bedrock_logs
WHERE eventSource = 'bedrock.amazonaws.com'
  AND eventName = 'InvokeModel'
GROUP BY json_extract_scalar(requestParameters, '$.modelId')
ORDER BY invocation_count DESC;