Change
fc524df
fc524dfa6a6ff0ba6b579e4510ea82fd069d5283 · commit on GitHub
aws-blog-feed: changed (671290 bytes, HTTP 200)
raw/aws-blog-feed/response.xml modified
- Source
- aws-blog-feed
- Lines added
- +4,169
- Lines removed
- -5,437
- Stored bytes at this commit
- 671,290
- Timestamp
- observed
- Raw artifact at this commit
- raw/aws-blog-feed/response.xml
Recorded headers
| observed_at | 2026-09-22T04:57:17.651Z |
|---|---|
| origin_date | null |
| status | 200 |
| final URL | https://aws.amazon.com/blogs/machine-learning/feed/ |
| etag | null |
| last-modified | Tue, 22 Sep 2026 00:16:58 GMT |
| date | Tue, 22 Sep 2026 04:57:17 GMT |
| age | null |
| cache-control | null |
| cf-cache-status | null |
| content-encoding | null |
| content-length | null |
@
@@ -5,7 +5,7 @@ <atom:link href="https://aws.amazon.com/blogs/machine-learning/feed/" rel="self" type="application/rss+xml"/> <link>https://aws.amazon.com/blogs/machine-learning/</link> <description>Official Machine Learning Blog of Amazon Web Services</description>-
<lastBuildDate>Fri, 18 Sep 2026 21:17:31 +0000</lastBuildDate>+
<lastBuildDate>Mon, 21 Sep 2026 18:30:34 +0000</lastBuildDate> <language>en-US</language> <sy:updatePeriod> hourly </sy:updatePeriod>@
@@ -13,6 +13,961 @@ 1 </sy:updateFrequency> <item>+
<title>xAI’s Grok 4.6 is now available in Amazon Bedrock</title>+
<link>https://aws.amazon.com/blogs/machine-learning/xais-grok-4-6-is-now-available-in-amazon-bedrock/</link>+
+
<dc:creator><![CDATA[Suheel Farooq]]></dc:creator>+
<pubDate>Mon, 21 Sep 2026 18:30:34 +0000</pubDate>+
<category><![CDATA[Amazon Bedrock]]></category>+
<category><![CDATA[Amazon Machine Learning]]></category>+
<category><![CDATA[Announcements]]></category>+
<category><![CDATA[Artificial Intelligence]]></category>+
<category><![CDATA[Foundation models]]></category>+
<category><![CDATA[Generative AI]]></category>+
<category><![CDATA[Intermediate (200)]]></category>+
<category><![CDATA[Launch]]></category>+
<guid isPermaLink="false">56dfeac3bfef33ff7b19f174cf3e455627c66990</guid>+
+
<description>xAI's Grok 4.6 is now available in Amazon Bedrock: a frontier model for long-running agents, coding, and knowledge work, with a 500K token context window and four reasoning effort levels. It runs on both the bedrock-mantle and bedrock-runtime endpoints, with Converse API and cross-…+
<content:encoded><p>Today, we are announcing that xAI’s Grok 4.6 is available in <a href="https://aws.amazon.com/bedrock/" target="_blank" rel="noopener">Amazon Bedrock</a>, adding a frontier model built for long-running agents, coding, and knowledge work to the Bedrock m…+
<p>This is xAI’s second model in Amazon Bedrock. When <a href="https://aws.amazon.com/blogs/machine-learning/introducing-grok-on-amazon-bedrock/" target="_blank" rel="noopener">Grok 4.3 became generally available</a>, xAI joined Amazon Bedrock as a model provider and the model was …+
<p>This post covers what xAI says Grok 4.6 is designed for, how it is packaged on Amazon Bedrock, and how to send your first request.</p>+
<h2 id="what-grok-4.6-is-built-for">What Grok 4.6 is built for</h2>+
<p>The capability and training details in this section come from xAI’s launch announcement, <a href="https://x.ai/news/grok-4-6" target="_blank" rel="noopener">Introducing Grok 4.6</a>.</p>+
<p>Grok 4.6 builds on Grok 4.5 with a particular focus on long-running agents and more ambitious interactive and visual work. xAI describes the model as staying with complex tasks across many steps, whether that is researching a topic, analyzing information, working across a code base, or turn…+
<p>On training, xAI reports a longer supplemental training run than Grok 4.5, using curated model-generated data for reasoning and advanced technical concepts, high-quality engineering data, and an improved optimizer and training recipe. It then used Grok 4.5 to regenerate the supervised fine-…+
<p>Two behaviors xAI calls out are worth noting for anyone building agents. On longer trajectories, the model began showing more self-testing and verification, checking its own work before moving on. It also produces stronger first passes on visual and interactive projects, establishing the st…+
<p>On safety, xAI states that Grok 4.6’s safeguards have been improved and calibrated in line with the model’s capabilities, backed by what it describes as its widest-ever suite of pre-deployment testing for capabilities and safeguard calibration, plus post-deployment and third-party testing. …+
<h2 id="reported-benchmark-results">Reported benchmark results</h2>+
<p>xAI reports that Grok 4.6 achieves frontier intelligence across several agentic coding and knowledge work benchmarks. These are the figures it published for Grok 4.6 High at launch on August 12, 2026:</p>+
<table style="height: 490px" border="1px" width="856" cellpadding="10px">+
<tbody>+
<tr>+
<td><strong>Evaluation</strong></td>+
<td><strong>Grok 4.6 High</strong></td>+
</tr>+
<tr>+
<td>AA Intelligence Index</td>+
<td>61</td>+
</tr>+
<tr>+
<td>GDPVal-AA v2</td>+
<td>1753</td>+
</tr>+
<tr>+
<td>CursorBench v3.2</td>+
<td>69.9%</td>+
</tr>+
<tr>+
<td>DeepSWE v1.1</td>+
<td>65.9%</td>+
</tr>+
<tr>+
<td>FrontierCode v1.1 (Extended)</td>+
<td>61.3%</td>+
</tr>+
<tr>+
<td>APEX-Agents</td>+
<td>57.5%</td>+
</tr>+
<tr>+
<td>Terminal-Bench v3.0</td>+
<td>26%</td>+
</tr>+
<tr>+
<td>APEX-SWE</td>+
<td>56.4%</td>+
</tr>+
<tr>+
<td>AA-Briefcase</td>+
<td>1577</td>+
</tr>+
<tr>+
<td>Harvey LAB (Vals)</td>+
<td>15.8%</td>+
</tr>+
</tbody>+
</table>+
<p>Source: xAI, according to <a class="uri" href="https://x.ai/news/grok-4-6" target="_blank" rel="noopener">https://x.ai/news/grok-4-6</a>.</p>+
<p>Several of those evaluations come from Artificial Analysis, so it helps to know what they measure. According to <a href="https://artificialanalysis.ai/models" target="_blank" rel="noopener">Artificial Analysis</a>, the Artificial Analysis Intelligence Index v4.1.1 is a composite…+
<p>Artificial Analysis also tracks cost and latency alongside intelligence. Its cost-per-task metric is a weighted average cost per Intelligence Index task, derived from input, cache hit, cache write, reasoning, and answer token prices, which is a useful lens if you are sizing a reasoning-heav…+
<h2 id="what-grok-4.6-adds-on-bedrock">What Grok 4.6 adds on Bedrock</h2>+
<p>Several Bedrock capabilities are new for this model rather than carried over from the earlier Grok launch.</p>+
<p><strong>The <code>bedrock-runtime</code> endpoint.</strong> Grok 4.6 is served on bedrock-runtime in addition to bedrock-mantle, so you can reach it with the AWS SDKs and the standard Bedrock control surface rather than only an OpenAI-compatible client.</p>+
<p><strong>The Converse API, including streaming.</strong> Both <code>converse</code> and <code>converse_stream</code> are available. This is the practical payoff of runtime support: one message shape across models, and streaming through the usual Converse e…+
<p><strong>An <code>xhigh</code> reasoning effort level.</strong> Effort runs low, medium, high, xhigh, extending the range at the top end for problems where a deeper pass is worth the tokens. On Converse, set it through <code>additionalModelRequestFields={"reason…+
<p><strong>Cross-Region inference.</strong> On bedrock-runtime you route through one of two inference profiles rather than pinning to a single Region. us.xai.grok-4.6 keeps traffic within the US geography when you have data residency requirements, and global.xai.grok-4.6 routes wor…+
<p><strong>Amazon Bedrock Guardrails.</strong> Grok 4.6 now supports Guardrails on bedrock-runtime across its APIs, giving you content filters, denied topics, personally identifiable information (PII) redaction, and word policies. You attach a guardrail by ID and version on the req…+
<p><strong>Invocation logging.</strong> With model invocation logging enabled, Grok 4.6 calls are captured as complete Amazon CloudWatch records: request body, response body, token counts including reasoning tokens, and the inference profile used. Useful for auditing agent runs whe…+
<p><strong>Prompt caching.</strong> Cached input is billed at roughly a quarter of the standard input rate, which matters for agents that resend a large system prompt or document on every turn. Caching applies to a repeated prefix, so keep stable content at the front of the request…+
<p>Tool calling, structured output, image input, response streaming, and encrypted reasoning content are available as well, but those date from the Grok 4.3 launch and are covered in that post.</p>+
<h2 id="how-grok-4.6-is-packaged-on-amazon-bedrock">How Grok 4.6 is packaged on Amazon Bedrock</h2>+
<p>Grok 4.6 accepts text and image input and returns text. Audio, speech, video, and embedding modalities are not supported, and it does not generate images. The model is reachable through two endpoints, and the model ID differs depending on which one you use:</p>+
<table border="1px" width="100%" cellpadding="10px">+
<tbody>+
<tr>+
<td><strong>Endpoint</strong></td>+
<td><strong>Model ID</strong></td>+
<td><strong>Base URL</strong></td>+
</tr>+
<tr>+
<td>bedrock-mantle</td>+
<td><code>xai.grok-4.6</code></td>+
<td>https://bedrock-mantle.{region}.api.aws/openai/v1</td>+
</tr>+
<tr>+
<td>bedrock-runtime</td>+
<td><code>us.xai.grok-4.6</code> (Geo) or <code>global.xai.grok-4.6</code> (Global)</td>+
<td>https://bedrock-runtime.{region}.amazonaws.com/openai/v1</td>+
</tr>+
</tbody>+
</table>+
<p><a href="images/image1.png" target="_blank" rel="noopener"><img src="https://d2908q01vomqb2.cloudfront.net/f1f836cb4ea6efb2a0b1b99f41ad8b103eff4b59/2026/09/17/ML-21784-1.png" alt="Architecture diagram of Grok 4.6 access paths on Amazon Bedrock through the bedrock-mantle and bedrock…+
<p>On the API side, Grok 4.6 supports the Responses API, the Chat Completions API, and the Converse API. The Invoke API is not supported.</p>+
<p>Feature support differs by endpoint, which is the detail most likely to shape your integration choice:</p>+
<p>On bedrock-mantle, supported features include client-side tool calling, reasoning, structured outputs, prompt caching, response streaming, projects, and abuse detection.</p>+
<p>On bedrock-runtime, supported features include reasoning, prompt caching, response streaming, invocation logs, and projects (default project only). Structured outputs, server-side tool use, intelligent prompt routing, count tokens, and application inference profiles are not supported on tha…+
<p>Tool calling works on both endpoints. The model returns a structured function request, your code executes it, and you pass the result back. On bedrock-runtime you can drive that loop through Converse’s <code>toolConfig</code> or the OpenAI-compatible <code>tools</code&g…+
<p>If your application depends on JSON Schema structured output, that points you at bedrock-mantle. If you want the Converse API or invocation logging, that points you at bedrock-runtime.</p>+
<h3 id="regions-and-inference-options">Regions and inference options</h3>+
<p>Availability differs by endpoint. On bedrock-mantle, Grok 4.6 is available for in-Region inference in US West (Oregon) (us-west-2) . On bedrock-runtime, in-Region inference is not offered. Instead, you invoke the model through cross-Region inference profiles. Geo cross-Region inference is a…+
<p>This is a change in shape from the Grok 4.3 launch, where, as noted in the <a href="https://aws.amazon.com/blogs/machine-learning/introducing-grok-on-amazon-bedrock/" target="_blank" rel="noopener">Grok 4.3 post</a>, the model used in-Region inference only and Geo and Global cro…+
<h3 id="service-tier-and-pricing">Service tier and pricing</h3>+
<p>Grok 4.6 supports three service tiers. Standard is pay-per-token with no commitment, selected by setting <code>"service_tier": "default"</code> or omitting the field. Priority delivers faster, prioritized processing for a premium (<code>"service_tier": "priority"</code&…+
<p>The other two tiers are priced as multipliers on those Standard rates: Priority at 1.75x, a 75 percent premium, and Flex at 0.5x, a 50 percent discount. So the same workload that costs $2.20 per million input tokens on Standard in-Region runs $3.85 on Priority and $1.10 on Flex, which makes…+
<p>For reference, xAI lists Grok 4.6 pricing starting at $2 per million input tokens and $6 per million output tokens, with a fast variant at twice the price. Always confirm current rates on the <a href="https://aws.amazon.com/bedrock/pricing/" target="_blank" rel="noopener">Amazon Bedro…+
<h2 id="send-your-first-request">Send your first request</h2>+
<p>Before your first call, confirm the model is available to you in the Bedrock console for the Region you plan to use. Grok 4.6 is served through inference profiles rather than on-demand throughput on the bare model ID, which is why requests name <code>us.xai.grok-4.6</code> or &l…+
<p>Grok 4.6 uses OpenAI-compatible APIs, so the OpenAI SDK works against either endpoint after you set the base URL. Install the SDK, and boto3 if you plan to use the Converse API:</p>+
<div class="hide-language">+
<pre><code class="language-bash">pip install openai+
pip install boto3</code></pre>+
</div>+
<p>Generate a long-term Amazon Bedrock API key from the Amazon Bedrock console for exploration, then set your environment. For bedrock-mantle:</p>+
<div class="hide-language">+
<pre><code class="language-bash">export OPENAI_API_KEY="&lt;provide your Bedrock API key&gt;"+
export OPENAI_BASE_URL="https://bedrock-mantle.us-west-2.api.aws/openai/v1"</code></pre>+
</div>+
<p>For bedrock-runtime:</p>+
<div class="hide-language">+
<pre><code class="language-bash">export OPENAI_API_KEY="&lt;provide your Bedrock API key&gt;"+
export OPENAI_BASE_URL="https://bedrock-runtime.us-east-1.amazonaws.com/openai/v1"</code></pre>+
</div>+
<p>A first request on bedrock-mantle with the Chat Completions API:</p>+
<div class="hide-language">+
<pre><code class="language-python">from openai import OpenAI+
+
client = OpenAI()+
+
response = client.chat.completions.create(+
model="xai.grok-4.6",+
messages=[+
{"role": "user", "content": "Can you explain the features of Amazon Bedrock?"}+
],+
)+
print(response)</code></pre>+
</div>+
<p>On bedrock-runtime the difference is the model name: you pass a cross-Region inference profile instead of the bare model ID. This example also switches to the Responses API to show that shape:</p>+
<div class="hide-language">+
<pre><code class="language-python">from openai import OpenAI+
+
client = OpenAI()+
+
response = client.responses.create(+
model="us.xai.grok-4.6",+
input="Can you explain the features of Amazon Bedrock?",+
)+
print(response)</code></pre>+
</div>+
<p>And through the Converse API with boto3. Because reasoning is active, the first content block carries the reasoning and the answer sits in a later block, so search the blocks for the text rather than indexing <code>content[0]</code>:</p>+
<div class="hide-language">+
<pre><code class="language-python">import boto3+
+
client = boto3.client("bedrock-runtime", region_name="us-east-1")+
+
response = client.converse(+
modelId="us.xai.grok-4.6",+
messages=[+
{"role": "user", "content": [{"text": "Can you explain the features of Amazon Bedrock?"}]}+
],+
inferenceConfig={"maxTokens": 2048},+
)+
+
blocks = response["output"]["message"]["content"]+
text = next(b["text"] for b in blocks if "text" in b)+
print(text)</code></pre>+
</div>+
<p>On Converse you set the effort level through additionalModelRequestFields rather than a reasoning parameter:</p>+
<div class="hide-language">+
<pre><code class="language-python">response = client.converse(+
modelId="us.xai.grok-4.6",+
messages=[{"role": "user", "content": [{"text": "What is 17*23? Number only."}]}],+
inferenceConfig={"maxTokens": 3000},+
additionalModelRequestFields={"reasoning_effort": "xhigh"},+
)</code></pre>+
</div>+
<p>Three operational notes. First, on bedrock-runtime, Grok 4.6 is not available for in-Region inference, so requests must name <code>us.xai.grok-4.6</code> or <code>global.xai.grok-4.6</code>.</p>+
<p>Second, <code>bedrock:InvokeModel</code> is evaluated against three resources: your account’s default project, the inference profile you name, and the underlying foundation model. The foundation model ARN is wildcarded across Regions because cross-Region profiles route outside t…+
<div class="hide-language">+
<pre><code class="language-json">{+
"Version": "2012-10-17",+
"Statement": [+
{+
"Effect": "Allow",+
"Action": "bedrock:InvokeModel",+
"Resource": [+
"arn:aws:bedrock:{region}:{account-id}:project/default",+
"arn:aws:bedrock:{region}:{account-id}:inference-profile/us.xai.grok-4.6",+
"arn:aws:bedrock:*::foundation-model/xai.grok-4.6"+
]+
},+
{+
"Effect": "Allow",+
"Action": "bedrock:CallWithBearerToken",+
"Resource": "*"+
}+
]+
}</code></pre>+
</div>+
<p>List every inference profile you plan to call. Profiles are scoped individually, so a policy naming <code>us.xai.grok-4.6</code> does not cover <code>global.xai.grok-4.6</code>.</p>+
<p>Third, the two authentication mechanisms cover different code paths. An Amazon Bedrock API key in <code>OPENAI_API_KEY</code> travels as a bearer token and authenticates the OpenAI-compatible calls on both endpoints. The boto3 Converse examples sign with SigV4 instead, drawing o…+
<p>Treat a long-term API key as an exploration-only credential. For production, the Grok 4.3 launch post recommends short-term bearer tokens generated from your IAM credentials with the <code>aws-bedrock-token-generator</code> package, because they expire automatically and keep acc…+
<h2 id="working-with-reasoning-effort">Working with reasoning effort</h2>+
<p>Reasoning is active on Grok 4.6 by default, and you configure how much of it the model spends through the reasoning parameter with low (the default), medium, high, or xhigh. The xhigh level is new relative to what the Grok 4.3 launch post documented, where the levels were none, low, medium,…+
<p>Reasoning content is encrypted. You can have it returned by passing <code>include: ["reasoning.encrypted_content"]</code> on a Responses API request, then send that content back on subsequent turns to give the model its own prior reasoning as context in a multi-turn conversation…+
<p>Encrypted reasoning is a Responses API feature, so this example uses the OpenAI client rather than the boto3 client from the Converse examples above:</p>+
<div class="hide-language">+
<pre><code class="language-python">from openai import OpenAI+
+
client = OpenAI() # OPENAI_BASE_URL points at the bedrock-runtime endpoint+
+
response = client.responses.create(+
model="us.xai.grok-4.6",+
reasoning={"effort": "high"},+
include=["reasoning.encrypted_content"],+
input="Explain quantum entanglement simply.",+
)+
print(response.output_text)</code></pre>+
</div>+
<p>Because reasoning is by default and effort is per request, effort level is a real cost and latency control. Run short extraction and classification calls at low, and reserve high or xhigh for planning steps and long agent trajectories where an early mistake compounds. Benchmarking effort le…+
<h2 id="get-started">Get started</h2>+
<p>Grok 4.6 on Amazon Bedrock gives you a model xAI built for long-running agents and ambitious interactive work, with a 500K token context window, four reasoning effort levels, image input, prompt caching, and a choice between the OpenAI-compatible bedrock-mantle endpoint and the bedrock-runt…+
<p>To start building, review the <a href="https://docs.aws.amazon.com/bedrock/latest/userguide/model-card-xai-grok-4-6.html" target="_blank" rel="noopener">Grok 4.6 model card</a> for the current Region list, feature matrix, and parameter details, and check the <a href="https://…+
<h2 id="sources">Sources</h2>+
<ul>+
<li>Amazon Bedrock Grok 4.6 model card: <a class="uri" href="https://docs.aws.amazon.com/bedrock/latest/userguide/model-card-xai-grok-4-6.html" target="_blank" rel="noopener">https://docs.aws.amazon.com/bedrock/latest/userguide/model-card-xai-grok-4-6.html</a></li>+
<li>xAI models in Amazon Bedrock: <a class="uri" href="https://docs.aws.amazon.com/bedrock/latest/userguide/model-cards-xai.html" target="_blank" rel="noopener">https://docs.aws.amazon.com/bedrock/latest/userguide/model-cards-xai.html</a></li>+
<li>xAI, Introducing Grok 4.6: <a class="uri" href="https://x.ai/news/grok-4-6" target="_blank" rel="noopener">https://x.ai/news/grok-4-6</a></li>+
<li>Artificial Analysis, model comparison and benchmark methodology: <a class="uri" href="https://artificialanalysis.ai/models" target="_blank" rel="noopener">https://artificialanalysis.ai/models</a></li>+
<li>AWS, Introducing Grok on Amazon Bedrock (Grok 4.3): <a class="uri" href="https://aws.amazon.com/blogs/machine-learning/introducing-grok-on-amazon-bedrock/" target="_blank" rel="noopener">https://aws.amazon.com/blogs/machine-learning/introducing-grok-on-amazon-bedrock/</a></…+
</ul>+
<hr style="width: 100%">+
<h2>About the authors</h2>+
<footer>+
<div class="blog-author-box" style="padding-top: 2.0em">+
<div class="blog-author-image" style="margin-right: 1.0em">+
<p><img loading="lazy" class="alignnone size-full wp-image-139858" src="https://d2908q01vomqb2.cloudfront.net/f1f836cb4ea6efb2a0b1b99f41ad8b103eff4b59/2026/09/21/Screenshot-2026-09-21-at-10.54.29 AM.png" alt="" width="100" height="117"></p>+
</div>+
<h3 class="lb-h4">Suheel Farooq</h3>+
<p>Suheel is a Principal Solutions Architect at AWS, specializing in artificial intelligence, machine learning, and generative AI. He helps Foundation Model Provider customers design, build, modernize, and scale their AI/ML and generative AI workloads on AWS. His experience spans the AWS AI/…+
</div>+
<div class="blog-author-box" style="padding-top: 2.0em">+
<div class="blog-author-image" style="margin-right: 1.0em">+
<p><img loading="lazy" class="alignnone size-full" src="https://d2908q01vomqb2.cloudfront.net/f1f836cb4ea6efb2a0b1b99f41ad8b103eff4b59/2026/09/17/ML-21784-3.jpg" alt="Ikenna Izugbokwe" width="100" height="133"></p>+
</div>+
<h3 class="lb-h4">Ikenna Izugbokwe</h3>+
<p>Ikenna is a Principal Solutions Architect at AWS specializing in networking, containers, and AI infrastructure. He guides model providers through scaling their training and inference systems while enabling rapid deployment of evolving frontier models on AWS. His work increasingly spans ag…+
</div>+
<div class="blog-author-box" style="padding-top: 2.0em">+
<div class="blog-author-image" style="margin-right: 1.0em">+
<p><img loading="lazy" class="alignnone size-full" src="https://d2908q01vomqb2.cloudfront.net/f1f836cb4ea6efb2a0b1b99f41ad8b103eff4b59/2026/09/17/ML-21784-4.jpg" alt="Fabio Branco" width="100" height="133"></p>+
</div>+
<h3 class="lb-h4">Fabio Branco</h3>+
<p>Fabio is a Senior Customer Solutions Manager at Amazon Web Services (AWS) and strategic advisor guiding foundational model providers in their go-to-market journey. Prior to AWS, he held Product Management, Engineering, Consulting, and Technology Delivery roles across multiple Fortune 500 …+
</div>+
<div class="blog-author-box" style="padding-top: 2.0em">+
<div class="blog-author-image" style="margin-right: 1.0em">+
<p><img loading="lazy" class="alignnone size-full" src="https://d2908q01vomqb2.cloudfront.net/f1f836cb4ea6efb2a0b1b99f41ad8b103eff4b59/2026/09/17/ML-21784-5.jpg" alt="Saurabh Trikande" width="100" height="133"></p>+
</div>+
<h3 class="lb-h4">Saurabh Trikande</h3>+
<p>Saurabh is a Senior Product Manager for Amazon Bedrock and Amazon SageMaker Inference. He is passionate about working with customers and partners, motivated by the goal of democratizing AI. He focuses on core challenges related to deploying complex AI applications, inference with multi-te…+
</div>+
<div class="blog-author-box" style="padding-top: 2.0em">+
<div class="blog-author-image" style="margin-right: 1.0em">+
<p><img loading="lazy" class="alignnone size-full" src="https://d2908q01vomqb2.cloudfront.net/f1f836cb4ea6efb2a0b1b99f41ad8b103eff4b59/2026/09/17/ML-21784-6.jpg" alt="Anirban Gupta" width="100" height="133"></p>+
</div>+
<h3 class="lb-h4">Anirban Gupta</h3>+
<p>Anirban is a Principal Engineer at AWS based in Seattle, USA, where he focuses on the design of secure, high-scale model-serving infrastructure for Amazon Bedrock. He has driven the technical work behind several foundation-model launches on the platform. Prior to joining Amazon Bedrock, h…+
</div>+
</footer></content:encoded>+
+
+
+
</item>+
<item>+
<title>How BMW Group detects cost anomalies across 14,000 cloud accounts</title>+
<link>https://aws.amazon.com/blogs/machine-learning/how-bmw-group-detects-cost-anomalies-across-14000-cloud-accounts/</link>+
+
<dc:creator><![CDATA[Tareq Haschemi]]></dc:creator>+
<pubDate>Mon, 21 Sep 2026 16:36:10 +0000</pubDate>+
<category><![CDATA[Advanced (300)]]></category>+
<category><![CDATA[Customer Solutions]]></category>+
<guid isPermaLink="false">b2786889523b42040f67f3b605d5e4d72111c12e</guid>+
+
<description>BMW Group operates CLEA, a FinOps platform monitoring more than 14,000 cloud accounts. This post shows how BMW added automated daily cost anomaly detection, moving from reactive dashboards to proactive alerts using Prophet forecasting, AWS Step Functions, and a serverless pipeline …+
<content:encoded><p><em>This post is co-written with Philipp Karg from BMW Group and Christopher Masurek from Data Reply.</em></p>+
<p>Cost anomalies are hard to spot when you run 14,000 cloud accounts. BMW Group operates Cloud Efficiency Analytics (CLEA), an in-house FinOps system built on AWS with Reply that monitors more than 14,000 cloud accounts across BMW Group’s cloud estate. CLEA began as a set of dashboards in <…+
<p>To close that gap, CLEA now runs anomaly detection every day and sends email to account owners when spending departs from its expected pattern.</p>+
<p>This post walks through the forecasting baseline, the filtering logic that decides which deviations are worth an alert, the alert engine, and the serverless architecture that processes every account daily for about $50 per month in compute.</p>+
<h2 id="what-clea-forecasts">What CLEA forecasts</h2>+
<p>CLEA ingests billing data daily from <a href="https://docs.aws.amazon.com/cur/latest/userguide/what-is-cur.html" target="_blank" rel="noopener">AWS Cost and Usage Reports</a> (CUR), the primary source, along with the equivalent billing exports from the other providers in BMW Gro…+
<p>A single AWS account running <a href="https://aws.amazon.com/ec2/" target="_blank" rel="noopener">Amazon Elastic Compute Cloud (Amazon EC2)</a>, <a href="https://aws.amazon.com/s3/" target="_blank" rel="noopener">Amazon Simple Storage Service (Amazon S3)</a>, <a h…+
<p>We use three terms throughout the rest of this post. <em>Expected spend</em> is the predicted cost for one account-service pair on one day, based on 365 days of history. <em>Actual spend</em> is the cost recorded in the billing data for that same account, service, an…+
<h2 id="forecasting-and-detection-pipeline">Forecasting and detection pipeline</h2>+
<p>CLEA builds its cost baselines with Prophet, the open source forecasting library from Meta. We chose it for its simplicity and its steady performance on cost time series. The model trains on 365 days of daily cost history for each account-service pair, with additive seasonality.</p>+
<p><a href="https://aws.amazon.com/step-functions/" target="_blank" rel="noopener">AWS Step Functions</a> orchestrates the daily run. A preparation AWS Lambda function discovers the active accounts and writes the list to Amazon S3 as JSON. A Distributed Map then fans the work out a…+
<p>The forecast output has two uses: a 12-month rolling forecast, and per-day predicted values that become the expected cost baseline for anomaly detection.</p>+
<p>We treat forecasting as a pluggable module. The interfaces are the input format (daily cost per account-service) and the output format (per-day predicted values with confidence intervals), so the forecasting engine can be swapped out without touching the detection and alerting layers that a…+
<h2 id="from-forecast-to-actionable-alert">From forecast to actionable alert</h2>+
<p>A forecast on its own is not an alert. Getting from one to the other takes three things: a baseline that each account-service pair can be measured against, a daily comparison that flags the days falling outside it, and a set of filters that decide which of those days are worth an owner’s at…+
<h3 id="setting-the-baseline">Setting the baseline</h3>+
<p>A fixed rule, such as alerting whenever daily spend passes a set dollar amount, does not hold up at this scale. Accounts grow, adopt new services, and ramp workloads on purpose, and a fixed rule reads all of that as anomalous. Set the threshold high enough to stay quiet for the largest acco…+
<p>The trade-off is that a model that adapts to a trend will eventually absorb one. A sustained step up in spend gets flagged for the first few days and then settles in as the new expected level as the training window catches up. Detection of this kind is strongest on spikes.</p>+
<p>With a forecast in place, detection becomes a daily comparison. For every account-service pair, CLEA calculates the impact: actual spend minus expected spend. Where actual cost falls outside the confidence interval Prophet produced, CLEA flags the day as a potential anomaly. Because the int…+
<h3 id="filtering-down-to-what-matters">Filtering down to what matters</h3>+
<p>Some services never enter the model. Before a detection runs, CLEA excludes low-spend services (averaging below $0.10 over the last 3 days), services with fewer than 10 days of history, and other specific line items and charge types that are not relevant to the forecast.</p>+
<p>CLEA also applies a deviation threshold: a flagged day must deviate by at least 40% from expected spend to stay in scope. From there, the remaining detections pass through two groups of filters. Generic thresholds apply to every account: an anomaly has to clear both the deviation threshold …+
<p><strong>Account-cluster filtering.</strong> A 900% jump sounds alarming until you look at the absolute numbers: An account that normally spends $0.10 on a service and then spends $1.00 has spiked, but the absolute overspend is negligible. CLEA sorts accounts into four clusters b…+
<table border="1px" width="100%" cellpadding="10px">+
<tbody>+
<tr>+
<td><strong>Cluster</strong></td>+
<td><strong>Trailing 3-month average spend</strong></td>+
<td><strong>Minimum impact to alert</strong></td>+
</tr>+
<tr>+
<td>1</td>+
<td>Less than $100k</td>+
<td>More than $300</td>+
</tr>+
<tr>+
<td>2</td>+
<td>$100k to $250k</td>+
<td>More than $500</td>+
</tr>+
<tr>+
<td>3</td>+
<td>$250k to $500k</td>+
<td>More than $750</td>+
</tr>+
<tr>+
<td>4</td>+
<td>More than $500k</td>+
<td>More than $1,000</td>+
</tr>+
</tbody>+
</table>+
<p><strong>Service-specific thresholds.</strong> Based on operational experience, certain services produce cost spikes as part of their normal usage pattern. <a href="https://aws.amazon.com/glue/" target="_blank" rel="noopener">AWS Glue</a>, <a href="https://aws.amaz…+
<p><strong>Account-specific overrides.</strong> Accounts on a reduced-sensitivity list must exceed three times the standard thresholds before an alert fires. This covers teams with known volatile workloads who asked for fewer notifications.</p>+
<p>Figure 1 shows how each layer narrows the set: a wide band of Prophet anomalies on the left, and on the right the few that survive both the generic thresholds and the case-specific overrides.</p>+
<div style="width: 810px" class="wp-caption alignnone">+
<a href="https://d2908q01vomqb2.cloudfront.net/f1f836cb4ea6efb2a0b1b99f41ad8b103eff4b59/2026/09/16/ML-21627-1.png" target="_blank" rel="noopener"><img src="https://d2908q01vomqb2.cloudfront.net/f1f836cb4ea6efb2a0b1b99f41ad8b103eff4b59/2026/09/16/ML-21627-1.png" alt="A funnel narrowing left…+
<p class="wp-caption-text">Figure 1: Each filtering layer reduces false positives</p>+
</div>+
<h2 id="calibration-and-what-automation-cannot-decide">Calibration, and what automation cannot decide</h2>+
<p>CLEA can see operations, usage types, and the resulting costs. It cannot see intent. Only the account owner knows whether a cost increase was planned, such as a new workload rollout or a migration. That boundary between detection and judgment is permanent, so we tune thresholds against user…+
<p>One more piece of bookkeeping matters at this scale. CLEA merges consecutive flagged days into date ranges, and the grouping logic reads every historical model snapshot instead of only the latest run. Without that, ranges fragment whenever Prophet reclassifies an individual day between exec…+
<h2 id="alert-engine-and-delivery">Alert engine and delivery</h2>+
<p>Alerting runs as a separate process once detection finishes. The engine queries the day’s active anomalies and deduplicates them by matching the detected date against the current date, so each anomaly produces a single alert. Anomalies that began within the last four days generate an alert.…+
<p>Every alert email carries the context an owner needs to act:</p>+
<ul>+
<li>The account ID and name, the account owners, and the department hierarchy, from BMW Group metadata sources.</li>+
<li>The affected service.</li>+
<li>The anomaly date range and duration.</li>+
<li>Expected spend against actual spend.</li>+
<li>The absolute impact and the percentage deviation.</li>+
<li>The accumulated impact across every concurrent anomaly on that account.</li>+
</ul>+
<p>An Excel attachment holds the full table.</p>+
<p>Figure 2 shows an alert for an example account. The email names the account and the recipient’s role. It states that costs exceeded expected spending by $1,775.13 and notes that anomalies are detected from spending spikes and may include false positives. Under Recommended actions it asks th…+
<div style="width: 810px" class="wp-caption alignnone">+
<a href="https://d2908q01vomqb2.cloudfront.net/f1f836cb4ea6efb2a0b1b99f41ad8b103eff4b59/2026/09/16/ML-21627-2.png" target="_blank" rel="noopener"><img src="https://d2908q01vomqb2.cloudfront.net/f1f836cb4ea6efb2a0b1b99f41ad8b103eff4b59/2026/09/16/ML-21627-2.png" alt="An anomaly alert email …+
<p class="wp-caption-text">Figure 2: An anomaly alert as an account owner receives it</p>+
</div>+
<h2 id="self-service-root-cause-analysis">Self-service root cause analysis</h2>+
<p>When an alert lands, the owner can investigate without involving the platform team. CLEA provides an anomaly dashboard in Amazon Quick Sight that lists the detected anomalies for each account, using the same fields as the alert email. Owners can widen the filter to include anomalies that we…+
<p>When you select an anomaly, CLEA opens a drill-down chart. Two bar charts break the account’s actual daily spend down by operation and by usage type, which is usually enough to confirm the spike and place it in time. A detail table lists the usage types driving the cost, such as <code>…+
<p>Figure 3 shows the drill-down for an account with a confirmed spike. The left chart plots daily usage cost by operation from early May to mid-June 2026. <code>RunInstances</code> dominates, and a single day reaches about $2,600 against a baseline near $900. The right chart plots…+
<div style="width: 810px" class="wp-caption alignnone">+
<a href="https://d2908q01vomqb2.cloudfront.net/f1f836cb4ea6efb2a0b1b99f41ad8b103eff4b59/2026/09/16/ML-21627-3.png" target="_blank" rel="noopener"><img src="https://d2908q01vomqb2.cloudfront.net/f1f836cb4ea6efb2a0b1b99f41ad8b103eff4b59/2026/09/16/ML-21627-3.png" alt="Two bar charts of daily…Diff display stops at 400 lines. The line counts above are from the whole diff. 61 lines shown here cut at 300 characters. The raw artifact at this commit is linked above.