Model Governance

Role: FinOps Lead Location: AI Governance → AI Models

The AI Models page is where you review foundation models available in your AWS environment, approve them for use in specific accounts and regions, and block models that are not permitted. No AI workload can proceed to IAM configuration until the model it uses is approved here.

The AI Models Catalog

When you open AI Models, the catalog shows every Bedrock foundation model discovered in your AWS environment via bedrock:ListFoundationModels. Models with observed CUR usage in the last 30 days are surfaced at the top.

Catalog columns:

Column	What it shows
Model	Model name and vendor (Anthropic, Amazon, Meta, Mistral, others)
Platform	Native Bedrock / Marketplace Claude / Claude Platform
Status	Pending Review / Approved / Implemented / Blocked
Input Price	$/1M input tokens (from AWS Pricing API, refreshed daily)
Output Price	$/1M output tokens
Accounts in Scope	Number of (account × region) scopes this model is approved for
Active Tasks	Open Cloud Engineer enablement tasks for this model

You can filter by vendor, platform, and status. Use the Status: Pending Review filter to work through models that have not yet been acted on.

Model Status Lifecycle

Pending Review → Approved (scoped) → Implemented (enabled in account)
             ↘ Blocked

• Pending Review — Model exists in your environment but has not been approved or blocked.

• Approved — You have approved the model for one or more (account × region) scopes. Cloud Engineer tasks have been generated.

• Implemented — The Cloud Engineer has completed the IAM configuration for at least one scope. The model is available to Product Owners in those accounts and regions.

• Blocked — The model is not permitted for use. No tasks are generated. Blocked models are not visible to Product Owners.

Approving a Model

1. Click the model row to open the model detail panel.

2. Review the model's current usage (accounts and regions with observed CUR spend in the last 30 days).

3. Click Approve for Use.

4. In the approval modal, select the accounts and regions you are authorizing. This is the ModelApprovalScope — approval is per (account × region), not blanket across your entire AWS estate.

5. Enter a rationale. This is required and is stored on the approval record for audit.

6. Before confirming, review the task count shown at the bottom of the modal. Each (account × region) combination generates one Cloud Engineer enablement task. Approving a model across 12 accounts and 3 regions creates 36 tasks.

7. Click Confirm Approval.

The model status changes to Approved. Cloud Engineer tasks are created immediately and appear in AI Tasks.

Note on scope: Approval is deliberately scoped. If you approve a model in pre-production accounts first and want to add production accounts later, you can extend the scope by opening the model again and adding additional (account × region) combinations. Each addition creates new Cloud Engineer tasks for the new scope.

Blocking a Model

1. Click the model row to open the model detail panel.

2. Click Block Model.

3. Enter a rationale. This is required.

4. Click Confirm Block.

Blocked models do not generate Cloud Engineer tasks and do not appear in the Product Owner's Spaces wizard. If a model with existing Approved scopes is blocked, the status changes to Blocked across all scopes and existing tasks are cancelled.

Bulk Approval

You can select multiple models using the checkboxes in the catalog and click Approve Selected. The approval modal will ask you to define the (account × region) scope, which applies to all selected models. A rationale is required and applies to all models in the batch.

The task count shown before confirmation reflects the total across all selected models and all selected scopes.

Pricing Refresh

Model pricing is pulled from the AWS Pricing API and cached. To refresh pricing for a model manually, open the model detail panel and click Refresh Pricing. The daily automatic refresh runs at 02:00 UTC.