Why do I get AccessDenied?

Check the user’s attached policy and exact billing:GetCredits action, not activate:GetCredits. Verify account ID, SCPs, boundaries, and explicit denies. Do not use root/administrator keys or billing:*.

Do I need IAM Billing Access for console access?

Console billing access and API permissions differ; that switch does not control Billing SDK/API. Reconcile with an existing authorized identity. The machine user needs no console login.

How do I fix signature or credential errors?

Check active, complete, matching keys and the global commercial account. ASIA and Bedrock keys are unsupported. For persistent time errors, give only codes and times to the Quota Monitor administrator for a clock check.

Why is the balance unchanged or different from estimated remaining?

Book Amount remaining differs from Estimated amount remaining, which includes unsettled consumption. We read only the former. Check query period, validity, and ownership; a refresh time is not a settlement time.

Does zero mean Bedrock has no funds?

No. The period may have no credits, or all may be expired/disabled. Postpaid capacity, other accounts’ shared credits, and funds outside the query period are excluded. Check AWS payment and service status directly.

AWS Credit Monitoring and Read-Only IAM Setup

Awaiting live-account verification

Guide updated 2026-10-02

Implemented against the official Billing GetCredits contract. Permissions and amounts await a real global commercial-region account. Documentation checks and mock tests do not verify live AWS accounts, all credit types, or MCP reconciliation.

Required credentials: IAM Access Key ID + Secret Access Key + 12-digit Account ID
Monitoring currency: USD · US dollar
What is monitored: Book credit balance · Last 364-day query period; Official GetCredits with payerAccountFlag=false for credits owned by the supplied account. The last 364 days avoids the one-year API boundary. Enabled, effective, unexpired remainingAmount values are summed exactly. Each credit retains eligible services, expiry, and sharing settings. This is not an organization-wide or Bedrock wallet.

Connect AWS / Bedrock (global commercial regions) to Quota Monitor

Identify global commercial-region credits
Using your existing authorized identity, open Billing and Cost Management → Credits. Verify USD, Amount remaining, eligible services, and expiry. Do not compare card limits, invoice totals, or Bedrock usage costs. China and GovCloud are unsupported. No test top-up is required.
Open official AWS / Bedrock (global commercial regions) page(opens in a new tab)
Copy the owning account’s 12-digit ID
Copy Account ID from the account menu without separators. It is not an alias, IAM username, organization ID, or ARN. The dedicated IAM user must belong to this account; do not confuse payer and member accounts.
03
Create the read-only credits policy
In IAM → Policies → Create Policy → JSON, replace all editor content with the example below. Name it QuotaMonitorCreditsReadOnly and create it. Confirm only billing:GetCredits and Resource *. The action cannot be scoped to a resource ARN. No billing:* or AdministratorAccess.
AWS / Bedrock (global commercial regions) read-only policy JSON
```
{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": [
        "billing:GetCredits"
      ],
      "Resource": [
        "*"
      ]
    }
  ]
}
```
Copies the complete JSON without keys or account details.
Open official AWS / Bedrock (global commercial regions) page(opens in a new tab)
Create and authorize a dedicated IAM user
Create quota-monitor-credits without console access or a password. Choose Attach Policies Directly and select QuotaMonitorCreditsReadOnly. Verify it on the user’s Permissions page. Do not copy administrator permissions or join an admin group. Attach the same policy if reusing a dedicated user.
Create the user’s access key
On the dedicated user, open Security Credentials → Access Keys → Create Access Key. Review long-term key alternatives. If you accept this version’s lack of role support, choose Other, add a description, and create. Never use root security credentials or delete production keys to free a slot.
Save the matching pair securely
Save Access Key ID and Secret Access Key on Retrieve Access Keys, optionally in a protected CSV. Secret is shown only once. Rotate lost credentials with an administrator. The ID is 20 characters beginning AKIA; Secret is 40 characters. ASIA, session tokens, and Bedrock keys are unsupported.
Connect AWS in your project
Choose AWS / Bedrock global commercial regions. Enter the 12-digit account ID and matching AK/SK in the masked form. Review permission and billing-period notes, then save. Currency is USD; no region, project ID, or custom endpoint is needed. Use this secure form for MCP setup too.
Reconcile each book credit
Refresh and review the query period, remaining amounts, inclusion status, services, expiry, and sharing. Compare the same account’s Amount remaining, not Estimated amount remaining. Only enabled, effective, unexpired USD remainingAmount is summed. Ambiguous scope or status fails instead of becoming zero.
Check payments and expiry in AWS
Use Open provider to review credit restrictions and expiry in AWS Billing. Follow your existing payment arrangements; zero book credits need not require a top-up. Review and rotate the dedicated key, and disable it in AWS when no longer used. Quota Monitor never tops up, changes payment methods, changes sharing, or enables/disables credits.

What Quota Monitor reads from AWS / Bedrock (global commercial regions)

Amount remaining is the book balance after the previous billing period and usually updates with billing. A successful refresh does not mean usage is settled to that moment. estimatedAmount includes unsettled estimates and is not used.
Only credits returned within the query period are covered, not all historical funds. An empty list means no credits in this period, not zero cash or imminent service interruption. Postpaid accounts may have no credits.
Coverage depends on each credit’s services, purchase types, and dates. Credits may not cover Bedrock, a model, or Marketplace. Owned credits may be shared outward; credits owned by other accounts and shared with you are excluded. Do not add balances across projects.
Credit-card limits, payment methods, cash prepayments, debt, Cost Explorer costs, and Free Tier usage are excluded. AWS China, GovCloud, non-USD billing, temporary ASIA keys, and Bedrock keys are unsupported.
The minimal policy follows the official action table, but live authorization remains unverified. SCPs, permission boundaries, and explicit denies may block queries. Failures never escalate permissions, request console cookies, or turn missing fields into zero.
The dashboard shows the latest successful snapshot. Manual refresh queries the provider again but cannot eliminate upstream billing delays. An old balance is not a new result after a failed query.

AWS / Bedrock (global commercial regions) FAQ and troubleshooting

Why do I get AccessDenied?: Check the user’s attached policy and exact billing:GetCredits action, not activate:GetCredits. Verify account ID, SCPs, boundaries, and explicit denies. Do not use root/administrator keys or billing:*.
Do I need IAM Billing Access for console access?: Console billing access and API permissions differ; that switch does not control Billing SDK/API. Reconcile with an existing authorized identity. The machine user needs no console login.
How do I fix signature or credential errors?: Check active, complete, matching keys and the global commercial account. ASIA and Bedrock keys are unsupported. For persistent time errors, give only codes and times to the Quota Monitor administrator for a clock check.
Why is the balance unchanged or different from estimated remaining?: Book Amount remaining differs from Estimated amount remaining, which includes unsettled consumption. We read only the former. Check query period, validity, and ownership; a refresh time is not a settlement time.
Does zero mean Bedrock has no funds?: No. The period may have no credits, or all may be expired/disabled. Postpaid capacity, other accounts’ shared credits, and funds outside the query period are excluded. Check AWS payment and service status directly.

Official AWS / Bedrock (global commercial regions) references

Prepared by Quota Monitor, not an official provider tutorial. Interfaces and permissions may change; check official pages. Verification is limited to the scope stated here.