glucolte

AWS AI Services

Architecture before services. Find the layer that owns the problem. Each cluster keeps related tiles beside one if this → choose that tree. Open a service tile for its role, payload/workflow, capacity options, and AWS references. Interactive diagrams sit within their related sections.

Architecture before services

What are you trying to minimize?

  • Operating effort
    Prefer managed capabilities when their controls fit.
  • Application changes
    Keep a compatible client/API boundary; change behind it.
  • Development effort
    Use supported features and integrations before custom code.

First meet latency, scale, residency, security, and availability requirements. Then compare what your team must operate, change, or build.

1. Model lifecycle

Select → customize → evaluate → release → monitor

Select & customize

As-is or customize? Evaluate the unchanged baseline first.

Close a quality gap — which lever?

What is actually missing?

Start with the unchanged model as a baseline, then prompt → RAG → justified customization. Tuning is not a source-refresh pipeline; quantization is a separate compression technique.

Where the model runs

Both host; choose by the control you need.

Amazon BedrockSageMaker AISageMaker NeoOutposts / Wavelength
Where does the model run?

Which control matters?

  • Managed model APIs
    Supported base, customized, or imported modelsBedrock
  • GPU / container / endpoint control
    Choose the serving modeSageMaker AI

    Which delivery pattern?

    • Interactive
      Real-time endpoint
    • Large / long queued request
      Asynchronous Inference
    • Intermittent CPU inference
      Serverless; no GPU, even with Provisioned Concurrency
    • Dataset offline
      Batch Transform
  • Device compilation
    Check supported hardware targetsSageMaker Neo
  • Local infrastructure / host control
    Trace every dependency and data locationOutposts / Wavelength

Both Bedrock and SageMaker host models. The fork is the control you need. Open a card for capacity, GPU, and billing comparisons.

Release & rollback

Approved ≠ deployed; retain a compatible rollback.

CodePipeline / CodeBuildModel RegistryAWS AppConfigParameter Store
Release, configuration, or compliance?

What changes?

  • Build and promote a release
    Automate checks and deploymentCodePipeline / CodeBuild
  • Approved model version
    Register evidence; deploy and verify separatelyModel Registry
  • Runtime setting / feature flag
    Validate, roll out, monitor, roll backAppConfig
  • Read a stored value
    Parameter tiers / throughput are separate choicesParameter Store
  • Credential with rotation
    Use Secrets ManagerKMS / Secrets Manager
  • Resource compliance
    Record/evaluate resource configurationConfig

Approved ≠ deployed. Retain a compatible rollback and evaluate the actual application route.

Implementation notes →

2. Knowledge / data flow

Source → preprocess → ingest → store → retrieve

Source & prepare

A catalogue describes data; ingestion builds search evidence.

Amazon S3AWS GlueData Wrangler / Processing
Prepare the right source

Which responsibility?

  • Source documents / artifacts
    Version objects and preserve lineageS3
  • ETL, catalogue, quality rules
    Validate or quarantine before indexingGlue
  • ML preparation / processing
    Visual transformations or processing jobsData Wrangler / Processing

A Data Catalog describes data; it is not the vector index. Source updates still need ingestion.

Preprocess / extract

Preserve meaning and structure before chunking.

Amazon TextractAmazon TranscribeAmazon RekognitionAmazon ComprehendComprehend MedicalBedrock Data Automation
Choose extraction from the output

What is the input?

  • PDF / scan
    Text, forms, tables, queries, expense/ID APIsTextract
  • Semantic business fields / media
    Supported output or custom blueprintBedrock Data Automation
  • Audio
    Transcribe; distinguish speakers from recorded channelsTranscribe
  • Image / video
    Supported visual analysisRekognition
  • Text entities, sentiment, PII
    General NLP; apply any required redactionComprehend
  • Clinical entities / PHI
    Supported medical APIsComprehend Medical

Readable is not always faithful: preserve tables, meaning, and source references before chunking.

Ingestion

Document → parse → chunk → metadata → embed → index.

Bedrock Knowledge BasesBedrock embedding modelsChunking strategiesOn this page ↓
Build searchable evidence

Which preparation decision?

Ingestion: parse → chunk → metadata → embed → index. Retrieval and reranking happen for each query.

Knowledge store

Choose by search needs, relationships, consistency, and cost.

Amazon OpenSearch ServiceAurora / RDS pgvectorAmazon S3 VectorsNeptune Analytics / GraphRAGAmazon Kendra
Choose a store or retriever

What does the workload need?

  • Lexical/vector/hybrid search controls
    Evaluate index, ranking, and capacity optionsOpenSearch Service
  • Vectors + relational transactions
    Supported PostgreSQL/pgvector integrationAurora / RDS pgvector
  • Vector storage/query economics
    Check filters, connectors, and measured latencyS3 Vectors
  • Relationships / multi-hop evidence
    Supported graph retrieval/analyticsNeptune Analytics / GraphRAG
  • Existing enterprise search
    Check eligibility, ACL sync, and connectorsKendra

Benchmark recall, latency, filtering, synchronization, and total cost. There is no universal vector-count cutoff.

Retrieval & debug

Find the first broken stage before changing the model.

Bedrock reranking
Wrong RAG answer — find the first broken stage

Is the right evidence in Retrieve results?

A reranker cannot recover an absent candidate. Fix retrieval before attributing every failure to the model.

Implementation notes →

RAG chunking strategies

Choose a sample document, then compare how each strategy preserves its meaning. Article and News use the same body text, with and without headings.

Identity / authenticationFederation / credentialsAuthorization / accessSecurity / auditWorkloads / dataDashed: setup / controlDotted: evidence / findingsSolid: request / data
Ingestion time · customer-configured preparation
  1. Approved source1DocumentVersioned input
    Parse
  2. Ingestion2ParsePreserve text and structure
    Extracted content
  3. Ingestion3ChunkChoose evidence units
    Chunks
  4. Ingestion4MetadataSource, version, trusted access scope
    Attributed chunks
  5. Ingestion5EmbedCompatible embedding model
    Vectors
  6. Search storage6Vector indexStore vectors + text references
Default · Start with sentence-aware service defaults.
Precision
Baseline to evaluate
Context
Sentence boundaries preserved
Cost
Low setup effort
Complexity
Managed default

The service decides the grouping; do not assume sentence preservation also keeps every rule and exception together.

Fixed-size · Set token size and overlap explicitly.
Precision
Smaller units can focus matches
Context
Overlap carries boundary text
Cost
More overlap duplicates indexed tokens
Complexity
Size + overlap configuration

Repeated word IDs mark the same content in adjacent chunks. This demo uses word windows and retained heading boundaries; AWS uses tokens and may preserve additional parsed document boundaries.

Semantic · Split around meaning or topic changes.
Precision
Topic-focused units may help
Context
Meaning boundaries guide splits
Cost
Additional semantic processing
Complexity
Tune and measure boundaries

Semantic splits can still separate a rule from a distant exception. They do not guarantee preservation of document hierarchy.

Hierarchical · Retrieve small child matches; return broader parent context.
Precision
Child match narrows the search
Context
Parent includes its child content
Cost
Larger returned context uses tokens
Complexity
Two levels + overlap

The parent encloses the child content. Standard hierarchical KB retrieval can substitute parents and collapse several child hits into fewer results; GraphRAG has a different contract.

Custom · Use a Lambda transformation for domain boundaries and metadata.
Precision
Domain-specific evidence units
Context
Keep related clauses together
Cost
Custom processing + operations
Complexity
Implement and maintain Lambda

For custom chunking, use the supported no-chunking configuration and Lambda/intermediate-S3 contract. Managed embedding/indexing can remain in place.

Query time · distinct from chunking
  1. Application1Trusted user scopeAuthenticate and derive permission scope
    Authorized retrieval query
  2. Query time2Retrieve candidatesSearch within permitted evidence
    Candidates
  3. Query time3Rank / contextRerank and prune within token budget
    Selected evidence
  4. Generation4ModelGenerate with permitted context

Measure retrieval and answer quality on your corpus; no strategy wins every trade-off. Metadata can be enriched at several preparation steps. New chunking requires re-ingestion; a reranker only sees its retrieved candidates. AWS chunking contract · Lambda transformations.

3. Runtime / inference flow

User/API → retrieval → prompt/context → model → response

Front door & streaming

Match the transport to the client exchange.

Amazon API GatewayAWS AppSync
How does the answer reach the client?

Which exchange?

  • One incremental response
    Supported REST API streaming integration + model eventsAPI Gateway Converse / ConverseStream
  • Bidirectional / push later
    WebSocket; manage connection and job stateAPI Gateway
  • GraphQL subscriptions
    Use the configured subscription/auth contractAppSync

For API Gateway, response streaming is REST-only. HTTP APIs do not provide that feature; check the whole transport path.

Prompt / context

Management stores versions; optimization proposes revisions.

Bedrock Prompt ManagementBedrock Prompt Optimization
Store a prompt or improve it?

Which job?

Versioning and optimization do not themselves approve a production release.

Model inference

Shared versus native request; evaluate sampling changes.

Converse / ConverseStreamInvokeModel / streamingInference parameters
Choose the API, then tune output

What needs attention?

No universal temperature/top-p preset guarantees quality. Check model-specific fields and token limits.

Session state, bots & voice

The model only sees state you pass.

Amazon DynamoDBAmazon LexAmazon Polly
State, fixed intents, or speech?

What does the application need?

  • Session / job / idempotency state
    Persist scoped records and enforce expiryDynamoDB
  • Fixed intents and slots
    Build the supported bot interactionLex
  • Text → speech
    Choose a supported voice enginePolly

These can compose. The model only receives the conversation state you include in the request.

Cost levers

Cache what repeats; route by measured difficulty.

Intelligent Prompt RoutingPrompt / response cachingAmazon CloudFront
Cut repeated work or route by difficulty

What repeats?

Cache keys and hits must respect tenant permissions, source versions, model/prompt configuration, and deletion.

Capacity & Regions

Reserve, spread, or stay on-demand within policy.

Provisioned ThroughputCross-Region inference
Choose capacity within the residency boundary

Traffic and processing location?

  • Low / variable live demand
    Supported on-demand inferenceBedrock
  • Sustained eligible demand
    Compare reserved service tier and Provisioned ThroughputProvisioned Throughput Bedrock
  • Burst capacity across approved Regions
    Supported geographic/global profile; approve every destinationCross-Region inference
  • Exactly one Region
    Verify the regional model path and all dependenciesBedrock
  • Delay-tolerant offline dataset
    Supported batch job, separate from one async invocationBedrock SageMaker AI

Capacity, service tiers, routing profiles, and streaming are different choices. Reservations can incur idle/commitment charges.

Slow versus starved

Response delivery and model capacity are different.

Slow response or insufficient throughput?

Where is time or capacity lost?

Streaming improves incremental delivery; it does not by itself add model throughput.

Implementation notes →

4. Pillar · Orchestration

Who chooses the next step? State · retries · approvals

Who drives the next step

Known states, model-selected actions, or one bounded handler.

Bedrock Agents ClassicStrands / Agent SquadAWS Step FunctionsBedrock FlowsAWS Lambda
Who chooses the next step?

Is the path known in advance?

  • Known states / approvals / long waits
    Step Functions Standard; callbacks and eligible .sync jobsStep Functions
  • Short, high-volume workflow
    Express ≤5 minutes; no callback tokens/.syncStep Functions
  • Visual GenAI pipeline
    Supported nodes and deterministic conditionsBedrock Flows
  • Model selects actions / specialists
    Bound the agent loop, authority, and iterationsBedrock AgentCore Strands / Agent Squad
  • One bounded handler
    Externalize durable stateLambda
  • Existing Classic agent
    Check existing-customer and migration guidanceBedrock Agents Classic

Express allows Wait states within its five-minute limit. External writes still need safe retry/idempotency behavior.

Events & queues

React, schedule, and buffer; retain workflow state separately.

EventBridge / S3 eventsAmazon SQS / SNS
Route events or retain work?

What arrives?

  • S3 event → supported direct target
    Configure notifications for Lambda, SNS, or standard SQSEventBridge / S3 events
  • Filter / fan-out / start workflow
    S3 EventBridge delivery + rule + supported targetEventBridge / S3 events
  • Bursty model/index work
    Queue + paced consumers, visibility timeout, DLQSQS / SNS
  • Ordered business steps / waits
    Use a workflow controllerStep Functions

Direct S3 notifications do not target Step Functions or SQS FIFO. A delivered event is not proof that downstream work succeeded.

Your agent platform

Code + identity + bounded tools.

Bedrock AgentCoreAgentCore IdentityMCP tool integration
Connect tools or host code?

What do you already have?

Runtime hosts; Gateway connects; MCP standardizes tool interaction. The target still authorizes each action.

When things fail

Retry ≠ re-plan ≠ circuit breaker; make side effects safe.

Recover from the actual failure

Which failure?

  • Transient failure / throttling
    Bound retries with backoff, deadlines, idempotencyStep Functions
  • Sustained dependency failure
    Circuit breaker + explicitly permitted fallback/degradationDynamoDB
  • Runaway agent work
    Bound iterations, tool authority, tokens, timeBedrock AgentCore Step Functions
  • Candidate release regresses
    Halt promotion or roll back a compatible approved versionModel Registry AppConfig

Retry, agent re-planning, circuit breaking, and rollback solve different failures.

Implementation notes →

5. Pillar · Security / governance

Identity · access · isolation · content safety

Who is the caller?

App users, workforce users, workloads, and agents.

Amazon CognitoIAM Identity CenterAccess decision treeOn this page ↓Identity protocolsOn this page ↓
Choose the caller path

Who or what needs access?

  • Customers / SaaS / mobile users
    User-pool sign-in/federation → JWT → application authorizationCognito
  • Employees accessing AWS
    Corporate IdP → Identity Center → assigned role/permission setIAM Identity Center
  • External workload
    Trusted OIDC assertion → STS → temporary role credentialsSTS
  • AWS-native workload
    IAM role → SDK temporary credentials → AWS APIIAM / Organizations SCPs
  • AI agent
    Check inbound caller trust and outbound tool credentialsAgentCore Identity

Cognito, workforce SSO, and OIDC can compose. Choose by principal, target, trust, and authorization needs.

What may they call?

AWS API permission and record entitlement are separate.

AWS IAM / Organizations SCPsAWS STSAmazon Verified PermissionsIAM Access AnalyzerIdentity architectureOn this page ↓
Authentication is not permission

Which access question?

A JWT is not an AWS access key. Temporary AWS credentials normally sign AWS requests with SigV4. SCPs and permission boundaries limit permissions; they do not grant them.

Private path

Configure connectivity and permission at their own boundaries.

VPC endpoints / PrivateLink
Private connectivity and enforcement

Which requirement?

The pipe and the permission are separate. An endpoint policy does not grant access or automatically close every other path.

Data controls

Keys, lake permissions, retention, HTTP protection, sensitive data.

KMS / Secrets ManagerAWS Lake FormationS3 Object Lock / LifecycleAWS WAFAmazon Macie
Choose the data control

What must be protected?

  • Encryption key / stored credential
    KMS / Secrets ManagerKMS / Secrets Manager
  • Integrated lake/table/row/column access
    Lake Formation; prevent bypass pathsLake Formation
  • Immutability / expiry
    Object Lock / Lifecycle; include derived copiesS3 Object Lock / Lifecycle
  • Supported HTTP abuse
    WAF rules and selected managed protectionsWAF
  • Sensitive data in S3
    Discover eligible objects; sanitize separatelyMacie

Data discovery, retention, network protection, and authorization address different obligations.

Content safety

Filter content; authorize documents and tools separately.

Bedrock Guardrails
Content safety or action authority?

What must be controlled?

Guardrails does not authorize access. Treat retrieved/tool content as untrusted and validate proposed actions outside the model.

Implementation notes →

Authentication decision tree

Start with the principal, target resource, trust relationship, and required access. These paths can compose: A + E for user sign-in with document rules; D + F for an AWS-hosted agent using tool credentials.

A · External application users
PrincipalHuman application userTargetYour application or protected API

Use a user pool when application sign-in and supported identity federation fit the product.

  1. User / provider1User / external IdPCustomers; optional Entra ID, Okta, OIDC or SAML federation
    Sign-in / federated assertion
  2. AWS identity service2Cognito user poolAuthenticates the user; issues tokens
    ID token → client; access token → API
  3. Customer application3Application / APIValidates signature, issuer, client/audience, expiry and token use
    Trusted principal + action + resource
  4. Customer policy4App authorizationCode or Verified Permissions decides; application enforces
Control plane · configure trust and policy

Configure the app client, trusted external IdPs, redirects and API token validation before accepting sign-ins.

What is exchanged?

User-pool JWTs: ID token for the client sign-in; access token for the configured API. Neither is an AWS access key.

  • An employee can also be an application user. Their corporate IdP can federate into Cognito; caller category alone does not forbid Cognito.
  • Need direct access to AWS APIs? A configured Cognito identity pool can exchange supported identity tokens for temporary IAM-role credentials; then use SigV4.
  • The backend often uses its own workload role for AWS calls. Its S3 permission does not decide which document the end user may read.

References: User pools · Identity pools.

B · Employees accessing AWS
PrincipalWorkforce userTargetAssigned AWS accounts or applications

Use Identity Center for centrally assigned workforce SSO and AWS account access.

  1. Workforce1EmployeeDeveloper or administrator
    Corporate sign-in
  2. Enterprise provider2Corporate IdPEntra ID, Okta, or a supported AD/federation setup
    SAML 2.0 assertion
  3. AWS workforce access3IAM Identity CenterValidates federation; applies user/group assignments
    Assigned account + permission set
  4. Target AWS account4Account role sessionPermission set provisions the IAM role/policies
    Temporary credentials → SigV4
  5. Target resource5AWS account / APIApplicable IAM policies and guardrails decide access
Control plane · configure trust and policy

Configure SAML trust and provision users/groups (SCIM or supported provisioning). Assign permission sets to accounts separately.

What is exchanged?

Portal/CLI sign-in enables an assigned account role session. AWS API calls use temporary credentials; SAML assertions are not S3 bearer tokens.

  • SAML handles federation; SCIM handles user/group provisioning. Provisioning alone is not sign-in.
  • A permission set templates IAM policies for account roles. It does not implement document-level rules in your custom assistant.
  • Active Directory needs a supported directory integration or federation service; a raw AD password is not an OIDC token.

References: External IdPs · Permission sets.

C · External workload identity
PrincipalMachine outside the AWS-native role delivery pathTargetAWS APIs through an assumed IAM role

Use supported OIDC federation when a workload can obtain an assertion from an explicitly trusted issuer.

  1. External compute1External workloadJob, service account, or automation
    Request workload assertion
  2. Trusted external issuer2OIDC providerIssues a signed job/service-account JWT
    OIDC JWT
  3. AWS federation boundary3AWS STS + role trustAssumeRoleWithWebIdentity validates issuer/claims and trust
    Access key ID + secret + session token
  4. Workload process4SDK role sessionUses expiring AWS credentials
    SigV4-signed API request
  5. AWS resource5AWS APIRole/resource policies and guardrails apply
Control plane · configure trust and policy

Create the IAM OIDC provider and a role trust policy scoped to the intended audience and subject, such as repository/branch or service account.

What is exchanged?

The JWT is the federation assertion. STS returns temporary AWS credentials with an expiration; the SDK uses them to sign requests.

  • Gate 1: may this principal assume this role? Gate 2: may that role session perform this resource action? Passing the first does not pass the second.
  • AssumeRoleWithWebIdentity is the OIDC/web-identity operation. Direct IAM SAML federation uses AssumeRoleWithSAML.
  • Kubernetes federation depends on the deployment. EKS Pod Identity uses a different native credential path; not every pod uses web-identity federation.

References: IAM OIDC trust · STS credentials.

D · AWS-native workloads
PrincipalAWS service-hosted workloadTargetAWS APIs using its workload role

Use service-integrated role credentials instead of shipping long-lived keys to the workload.

  1. AWS compute1AWS workloadLambda, EC2 instance, or ECS task
    Service-integrated role assumption
  2. AWS IAM / STS2Trusted IAM roleExecution role, instance profile role, or task role
    Rotating temporary credentials
  3. Workload process3SDK credential chainRetrieves provided credentials; SDK handles signing
    SigV4-signed request
  4. Target resource4AWS APIAuthorizes role session, action, resource and context
Control plane · configure trust and policy

Configure the service trust policy and attach the correct execution role, EC2 instance profile, or ECS task role. Grant only required permissions.

What is exchanged?

Temporary role credentials, not an end-user JWT. Let supported SDK credential providers obtain and refresh them.

  • The ECS task role is for application calls; the task execution role supports tasks such as pulling images and delivering logs.
  • A role is a permission-bearing identity, not a permanent access key. Trust allows assumption; permissions govern resulting actions.

References: Roles for AWS services · Request signing.

E · Enterprise application authorization
PrincipalAlready authenticated application user or agentTargetOne application resource and action

Use application policy, optionally Verified Permissions, when access depends on business entities and context.

  1. Trusted identity input1Authenticated identityValidated token/session establishes the principal
    Principal + requested action/resource
  2. Enforcement point2Application / APIDerives tenant and trusted resource context
    Authorization request
  3. Application policy store3Verified PermissionsCedar policies evaluate supported entities/context
    ALLOW / DENY decision
  4. Customer application4App enforcementStops denied calls; applies permitted scope
    Authorized filter / business API call
  5. Tenant data / business system5Document / actionRetrieval and action APIs enforce the scope
Control plane · configure trust and policy

Define the Cedar schema/policies, trusted identity source and resource attributes. Keep AWS role permissions and application policies distinct.

What is exchanged?

A principal/action/resource/context request, or supported identity-source token via IsAuthorizedWithToken. An ALLOW is a decision, not AWS credentials.

  • Verified Permissions does not perform user sign-in. Its token-based APIs can validate supported identity-source tokens while evaluating policy.
  • The application is the policy enforcement point: deny on failed authorization and prevent direct retrieval or tool paths that bypass it.
  • RAG must enforce tenant/document scope before context assembly. A backend IAM role that can query the KB does not imply every user may see every chunk.

References: Verified Permissions · Token identity sources.

F · AI agents
PrincipalCaller, agent workload, and downstream user delegationTargetAgent Runtime/Gateway, then its tools

Use AgentCore identity capabilities to connect supported inbound authentication and outbound credential needs.

  1. Caller identity1Caller / IdPSupported IdP authenticates user or machine
    JWT bearer; IAM/SigV4 alternative
  2. Agent ingress2Runtime / GatewayConfigured inbound authorizer checks trust and claims
    Authorized invocation context
  3. Agent execution3Agent workloadProposes an allowed tool call
    Authorized credential request
  4. Credential broker / vault4AgentCore IdentitySupported OAuth/API-key credential access
    Scoped downstream credential
  5. Agent execution5Agent tool clientPresents credential to the target
    OAuth access token / API key / AWS SigV4
  6. Tool / business resource6Downstream APIEnforces scope, tenant and business rules
Control plane · configure trust and policy

Configure inbound JWT discovery/claims or IAM permissions, outbound credential providers, workload access and any user consent required by the flow.

What is exchanged?

Inbound caller tokens and outbound tool credentials are distinct. OAuth user delegation may require consent; AWS targets can use authorized IAM credentials.

  • Inbound authentication at Runtime/Gateway and outbound credential brokerage have separate configurations. Do not assume the incoming JWT is valid for every tool.
  • AgentCore Identity does not make every proposed action permissible. Target scopes, Gateway Policy where configured, and business authorization still apply.

References: Inbound JWT authorizer · Inbound and outbound example.

Identity protocols

JWT is a format; OAuth grants API access; OIDC adds user authentication; SAML federates enterprise sign-in; STS issues AWS credentials.

Identity / authenticationFederation / credentialsAuthorization / accessSecurity / auditWorkloads / dataDashed: setup / controlDotted: evidence / findingsSolid: request / data
JWT · A token format

A compact claims container, often signed. The protocol and token profile define how it is used.

  1. Trusted signing authority1IssuerCreates claims
    Signed JWT
  2. Client / transport2Token holderCarries the token to its intended recipient
    JWT in the expected flow
  3. Validation boundary3RecipientChecks signature, issuer, intended recipient and lifetime
Header.Claims payload.Signature
iss · issuer
Which trusted authority issued it?
sub · subject
Which user or workload does it identify?
aud · audience
Which recipient is it intended for?
exp · expiration
When must it stop being accepted?
Signature
Verify against the trusted issuer's permitted keys/algorithms.
  • Common claims: iss = issuer; sub = subject; aud = intended audience; exp = expiry. Requirements depend on the token profile.
  • Signature validation detects tampering and authenticates the trusted signer. Decoding base64url is not validation; a signed JWT is not necessarily encrypted.
  • JWT is not an authentication protocol. An OAuth access token can be JWT-shaped or opaque.

References: JWT specification.

OAuth 2.0 · Delegated authorization

Obtain limited access to a protected resource. This example uses the authorization-code flow with PKCE.

  1. Client1ApplicationStarts code + PKCE flow
    Authorization request + code challenge
  2. Provider2Authorization serverUser authentication / consent as required
    Authorization code
  3. Application3Client callbackReceives and redeems code
    Code + PKCE verifier
  4. Provider4Token endpointValidates code and client/PKCE contract
    Access token
  5. Application5API clientHolds the scoped access token
    Access token
  6. Resource server6Protected APIValidates token and required scopes/policy
  • The code is exchanged at the token endpoint; it is not the access token. Other grants, such as client credentials, serve different principals.
  • OAuth alone does not standardize a user login result for the application. ID tokens come from OIDC.

References: OAuth framework · PKCE.

OIDC · Authentication on OAuth 2.0

Add a standardized user identity result to an OAuth flow by requesting the openid scope.

  1. OIDC client1ApplicationStarts sign-in with openid scope
    Authorization request + PKCE challenge
  2. Trusted IdP2OpenID ProviderAuthenticates the user
    Authorization code
  3. Application3Client callbackRedeems the code
    Code + PKCE verifier
  4. Trusted IdP4Token endpointIssues the authentication result
    ID token + access token
  5. Client validation5ApplicationValidates ID token; creates login session
    Access token for intended API
  6. Resource server6Protected APIValidates its token contract and policy
  • An ID token tells the client about the authentication. Its audience identifies the client; it is not a general-purpose API access token.
  • The API applies its configured access-token contract. Validate issuer, intended audience/client, expiry, signature and token type as required.
  • Some integrations explicitly accept ID tokens. Follow that integration's documented contract; do not substitute token types merely because both are JWTs.

References: Cognito OIDC tokens · Token validation.

SAML 2.0 · Enterprise federation

Exchange an XML assertion between an explicitly trusted identity provider and a service provider.

  1. Workforce1EmployeeStarts enterprise SSO
    Sign-in
  2. Corporate IdP2Microsoft Entra IDAuthenticates the employee
    Signed SAML assertion
  3. AWS service provider3IAM Identity CenterValidates SAML trust; creates workforce session
  • Metadata/certificates establish the trust relationship. Validate signature, issuer, recipient/audience and validity under the integration contract.
  • SAML is not a JWT. SCIM provisions users/groups; it is separate from the SAML sign-in. Direct IAM SAML federation can use AssumeRoleWithSAML.

References: Workforce federation · Direct IAM SAML.

AWS STS · Temporary AWS credentials

A trusted federation assertion can be exchanged for an authorized role session. STS is an AWS service, not a login protocol.

  1. Trusted external issuer1OIDC providerIssues a signed job/service-account JWT
    OIDC JWT
  2. AWS federation boundary2AWS STS + role trustAssumeRoleWithWebIdentity validates issuer/claims and trust
    Access key ID + secret + session token
  3. Workload process3SDK role sessionUses expiring AWS credentials
    SigV4-signed API request
  4. AWS resource4AWS APIRole/resource policies and guardrails apply
  • For web identity, call AssumeRoleWithWebIdentity. AWS validates the token/provider and role trust conditions before issuing credentials.
  • The result contains access key ID, secret access key, session token and expiration. SDKs generally sign AWS requests with SigV4.
  • Authentication tokens do not automatically grant IAM permissions. The role/session and applicable resource policies, boundaries and SCPs still constrain actions.

References: STS operations · SigV4.

AWS authentication and authorization

Who is the principal? Then may that principal perform this action on this resource? Authentication and federation supply trusted identity; authorization evaluates the requested access.

Identity / authenticationFederation / credentialsAuthorization / accessSecurity / auditWorkloads / dataDashed: setup / controlDotted: evidence / findingsSolid: request / data
Identity-provider trust boundary
Microsoft Entra IDOktaOn-premises AD / federation serviceOther supported OIDC / SAML IdPsCognito user pools · AWS-hosted IdP

Configure each relying party to trust its issuer and token/assertion contract. The same corporate IdP can support workforce SSO and application sign-in through different integrations.

PrincipalAuthentication / federationSession or credentialEnforcement at target
App userCognito user poolMay federate external IdPsID / access JWTClient login / API accessApplication policyCode / Verified Permissions
Workforce userIdP → Identity CenterWorkforce SSOAssigned role sessionAWS account temporary credentialsAWS IAMAccount role permissions
Machine / workloadOIDC issuer or AWS serviceExternal / native role trustAWS STS role sessionTemporary credentials → SigV4AWS IAMAction + resource + context
AI agentRuntime / Gateway ingressConfigured JWT or IAM authorizerAgentCore IdentitySupported outbound credentialsTool / business APITarget scope and action rules
Control plane · configured before requests
Role trust policyWho may assume the role?STS evaluates the supported federation/service trust.
Permission ceilingsIAM boundary / session policy / SCPApplicable limits do not grant permissions; explicit deny prevails. SCPs constrain member accounts, not management-account principals.
IAM Access AnalyzerPolicy validation and access findingsAnalyzes external, internal or unused access as configured; it is not the request authorizer.

Configured trust → token/credential validation → policy evaluation → permitted request. Access Analyzer · Permissions boundaries · SCPs.

6. Pillar · Evaluation & observability

Quality before release + evidence from production

Prove quality

Held-out data + rubric + critical-cohort release gates.

Bedrock EvaluationsGround Truth / A2IClarify / Model MonitorModel Cards / Dashboard
Prove quality before release

What must the output satisfy?

Compare baseline/candidate on the same important cohorts. A citation, model confidence, or completed evaluation job alone does not prove correctness.

Watch production

Choose evidence that answers the operational question.

Amazon CloudWatchCloudWatch SyntheticsAWS cost toolsOpenTelemetry / X-Ray
Quality or runtime health?

What is the symptom?

  • Wrong / inconsistent answers
    Task, retrieval, answer-quality evaluationBedrock Evaluations
  • Tokens, failures, latency trends
    Metrics and alarmsCloudWatch
  • Which dependency/stage is slow?
    Instrumented spans and correlation IDsOpenTelemetry / X-Ray
  • Known user/API journey broke
    Configured canary plus output/tool assertionsCloudWatch Synthetics
  • Unusual billed spend
    Cost Explorer, Budgets, anomaly detectioncost tools

Operational health and answer quality need different evidence. Instrument the application, retrieval, model, and tools together.

Security, compliance & audit

AWS assurance and customer workload evidence have different owners.

AWS CloudTrailModel invocation loggingAWS ConfigAWS ArtifactAWS Audit ManagerAmazon InspectorAWS Security HubSecurity / audit mapOn this page ↓
Select the evidence, not just a security label

What do you need to know?

  • AWS compliance reports / agreements
    Retrieve AWS evidence on demandArtifact
  • Customer framework assessment
    Configured evidence collection; eligibility appliesAudit Manager
  • Resource configuration / rule compliance
    Configurations, changes, evaluationsConfig
  • Who called which API?
    Supported account/API eventsCloudTrail
  • What prompt/response was captured?
    Opt-in supported content loggingModel invocation logging
  • Workload vulnerabilities
    Supported workload coverage/scansInspector
  • Prioritized combined security findings
    Supported services and selected bundle/coverageSecurity Hub

Artifact is not a continuous workload auditor. Configure collection, review findings, and resolve issues; see the shared-responsibility guide.

Implementation notes →

AWS security, compliance and auditing

AWS secures its underlying cloud infrastructure. Customers configure access, data protection, workload controls and audit coverage according to the service and shared responsibility model.

Identity / authenticationFederation / credentialsAuthorization / accessSecurity / auditWorkloads / dataDashed: setup / controlDotted: evidence / findingsSolid: request / data
AWS responsibility · security of the cloud
AWS-managed infrastructureFacilities, hardware and managed service layers
AWS ArtifactRetrieve AWS reports, certifications and agreements on demand.Not a continuous infrastructure auditing engine.
AWS assurance reports authorized customer retrieves on demand auditor / manual evidence selection
Customer responsibility · security in the cloud

These managed services run on AWS. The customer selects coverage, controls and frameworks, reviews evidence, and fixes findings.

AWS ConfigResource configuration complianceRecord supported resource configurations/history; evaluate configured rules.A compliant rule result does not establish all application or framework obligations.
AWS CloudTrailAPI activity auditingRecord supported AWS API activity and account events for investigation.Enable needed event coverage, especially data events; not a prompt-content log.
Amazon InspectorVulnerability managementContinually assess supported EC2, ECR and Lambda workloads for applicable vulnerabilities/exposure.Supported scan types and resource eligibility differ; it does not scan all possible assets.
Amazon MacieSensitive data discoveryDiscover/classify supported sensitive content in eligible S3 general purpose buckets.Findings do not themselves redact data; unsupported objects need another path.
AWS Security HubFindings aggregation and prioritizationCentralize, correlate and prioritize supported findings; Security Hub CSPM includes posture checks and service integrations.Use supported integrations. Findings need triage and remediation; raw CloudTrail logs are not automatically findings.
Inspector / Maciefindings →Security Hub / CSPM
Config / CloudTrail / supported Security Hub controlsconfigured evidence →Audit Manager
AWS Audit ManagerFramework audit evidenceContinuously collect supported evidence from configured sources for selected framework controls, such as supported ISO 27001 controls; add manual evidence where needed.Collection frequency varies by source. Evidence is not certification; existing-account/Region availability applies.

Arrows show supported integrations and selected control evidence, not every log or finding automatically flowing into every assessment. Audit Manager availability and evidence scope · Supported framework versions.

Separate application configuration path
AWS AppConfigValidate and deploy configuration/feature flags through controlled rollouts; apps retrieve them through supported agents/APIs.Separate from resource security auditing. The application must read and apply deployed values.
Application runtimeSupported agent/API retrieves deployed valuesThe application validates and applies its model routes, settings and feature variants.
Control plane · Administrator validate + deploy AppConfig
Runtime retrievalRuntime agent/API → AppConfig: request deployed configurationAppConfig → runtime: configuration values to apply

Audit and findings paths carry metadata/evidence; they are not the application's user/model data path. Collection does not certify compliance or automatically remediate every issue. AWS shared responsibility model.

7. Packaged apps

Buy versus build

Packaged assistants

Product workflow versus custom application ownership.

Amazon Q BusinessAmazon QuickAmazon Q Developer
Buy an experience or build an application?

Which ownership fits?

  • Packaged employee experience
    Check connectors, identity, permissions, and planQuick
  • Existing Q Business workload
    Check subscription/index choices and migrationQ Business
  • Developer assistance / modernization
    Supported development and transformation workflowsQ Developer
  • Custom UX and business tools
    Own the application and authorizationBedrock Bedrock AgentCore

Implementation notes →

Connected architectures

Trace the handoffs. Each node opens the same service card used in the clusters.

Documents with approval

A known batch of reports needs extraction, analysis, and a human decision.

  1. EventBridge / S3 eventsObject-created event
  2. AWS Step FunctionsStandard + Map
  3. Bedrock Data AutomationExtract and validate
  4. Amazon BedrockAnalyze
  5. AWS Step FunctionsCallback approval

Map iterates the reports; approval waits in the workflow. The final business write needs authorization and idempotency.

A maintenance action

An agent diagnoses a pump and proposes a work order.

  1. Bedrock AgentCoreRun the agent
  2. MCP tool integrationRead permitted evidence
  3. AWS Step FunctionsApprove a proposed write
  4. Amazon DynamoDBTrack durable action identity

The maintenance API authorizes the exact plant/action and reconciles retries. Conversation memory is not the plant record.

Fresh, governed knowledge

New manuals must become searchable without indexing invalid or sensitive text.

  1. Amazon S3Version the source
  2. AWS GlueValidate and redact
  3. Bedrock Knowledge BasesPace sync and inspect failures
  4. Bedrock rerankingSelect useful context

Compare retrieval before generation. A reranker cannot fix missing ingestion, and metadata scope must come from trusted identity.

A voice assistant

Users speak and receive incremental spoken replies.

  1. Amazon TranscribePreserve speaker turns
  2. Converse / ConverseStreamStream generated text
  3. Amazon PollySynthesize speech
  4. Amazon DynamoDBPersist scoped state/ratings

Choose a compatible streaming path at every hop and measure end-to-end latency; use WebSockets when bidirectional push is required.

Promote a candidate safely

A prompt/model change must pass quality checks and reach the intended route.

  1. CodePipeline / CodeBuildEvaluate held-out cases
  2. Model RegistryApprove model artifact
  3. SageMaker AIDeploy and verify
  4. AWS AppConfigRoll out route/config

Prompt-only changes may not need a model package. Verify the actual live version; sandbox shadow writes and retain a compatible rollback target.

Architecture reference

Model lifecycle · implementation notes

Bedrock: model APIs and customization

Bedrock supplies managed model APIs. Start with a prompt and authorized evidence; consider supported customization when evaluation shows a stable behavior gap. Customization options.

Bedrock service tiers
Option Use / constraint Cost driver
Standard (default) Everyday interactive inference Model input/output usage
Priority Higher scheduling priority for latency-sensitive requests Premium usage rates
Flex Lower-priority, delay-tolerant work Discounted usage rates
Reserved Sustained reserved input/output TPM; overflow uses Standard Monthly capacity; 1- or 3-month commitment

Service tiers differ from Provisioned Throughput. Check model/API/Region eligibility; Bedrock manages the GPU infrastructure.

AWS references: Service tier contracts · Bedrock rates.

SageMaker: choose how the model runs

Choose SageMaker when you need control over model artifacts, containers, GPU instances, or endpoint scaling.

SageMaker hosting: capacity, GPU, and cost
Option Use / constraint Cost driver
Real-time Interactive serving; chosen CPU/GPU instances Running instances/storage, including idle capacity
Asynchronous CPU/GPU queue; up to 1 GB / 1 hour; configurable scale-to-zero Running instances plus S3/data usage
Batch Transform CPU/GPU jobs over a known dataset Job instances plus storage/data usage
Serverless — on-demand CPU only: NO GPU; cold starts; no VPC configuration/Data Capture Memory × execution duration plus data; no idle compute
Serverless — Provisioned Concurrency CPU only: NO GPU; warm capacity; serverless exclusions remain Warm capacity plus execution/data

Provisioned Concurrency warms CPU environments. It does not add GPU support.

AWS references: Deployment options · SageMaker rates.

From artifact to live endpoint
Prepare → train/tune → evaluate → register + approve model package
        → CreateModel → CreateEndpointConfig → Create/UpdateEndpoint
        → wait until ready → test the actual application route

Version the model, adapter, tokenizer, and container together. Registration records a candidate; deployment loads it onto serving resources. Keep a compatible rollback. Pipeline steps.

Capacity: Spot training needs interruption recovery/checkpoints. Savings Plans discount eligible usage; training plans reserve specified capacity. Compare them in the SageMaker card.

Development, features, and edge deployment

Canvas supports visual ML workflows; Data Wrangler/Processing prepares data. Feature Store’s online store serves current features; its offline S3 store holds training history. Use point-in-time data to avoid leakage. Feature Store.

Neo compiles for supported targets. Outposts/Wavelength supplies infrastructure; check where every dependency and data flow runs. Neo.

Configuration and controlled rollout
AppConfig: application → environment → configuration profile/version
Deploy → validate → gradual rollout → monitor / rollback
Runtime agent/API → retrieve configuration → apply settings

Parameter Store holds values; AppConfig controls rollout; Secrets Manager protects credentials; AWS Config evaluates resource configuration. Feature flags still need server-side entitlement checks. AppConfig deployment.

Shared release standards

Package reusable infrastructure/runtime code, version it, and gate promotion on evaluation. Open the service cards for configuration tiers and pipeline/build modes.

Knowledge / data flow · implementation notes

Choose the retrieval responsibility

Knowledge Bases can integrate supported backing stores: choosing OpenSearch does not require a wholly custom RAG pipeline. Measure retrieval before judging the generated answer. Knowledge Bases.

Extract and validate before indexing

Textract extracts OCR/forms/tables; BDA uses supported standard outputs or custom blueprints. Validate extracted fields before writing business records or embeddings.

Text example: “Great battery, terrible screen.” Comprehend DetectSentiment describes the whole review; DetectTargetedSentiment describes individual entity mentions. API comparison.

For audio, Transcribe speaker labels identify voices, not clinical roles. Comprehend Medical detects supported clinical entities/PHI; apply and verify redaction before downstream writes. See the service cards for request/output shapes.

Keep evidence traceable and fresh

Preserve source/version metadata on derived chunks. Use Glue quality rules to reject or quarantine bad data. Re-ingest updates and delete stale derived copies; an S3 event alone does not make the index current.

Explore chunk boundaries, overlap, and parent context in the interactive guide.

Knowledge Bases: ingestion and query shape
Source → parse/chunk/embed → StartIngestionJob → inspect completion
Question → Retrieve → optional rerank → evidence → model

Query fragment — customer-managed KB: build the filter from verified backend identity; keep the user from supplying their own tenant scope.

{
  "retrievalConfiguration": {
    "vectorSearchConfiguration": {
      "filter": {"equals": {"key": "tenantId", "value": "TRUSTED_TENANT_ID"}},
      "numberOfResults": 10
    }
  }
}

Store matching metadata during ingestion and enforce the same policy on tool APIs. Source S3 permissions do not protect indexed copies. Managed KB and customer-managed KB have different API/ACL contracts. Query configuration, KB types.

Embeddings, ranking, and search tuning

Use compatible embedding models/versions for documents and queries; changing them requires re-embedding. A reranker can reorder retrieved candidates but cannot recover missing evidence.

OpenSearch index/search parameters trade memory and query effort for recall. Benchmark with real queries before scaling. k-NN tuning.

For existing Kendra workloads, search feedback helps diagnose missing content and ranking. Check its availability notice before considering a new application. Store capacity/pricing comparisons remain in each service card.

Runtime / inference flow · implementation notes

Understand the request and response

API Request shape Response handling
Converse / ConverseStream Shared messages/content structure Message or incremental events, usage, stop reason
InvokeModel / streaming Model-provider-specific JSON Decode the provider’s response/events

Converse SDK arguments: modelId becomes an HTTP path parameter; the other fields form the body.

{
  "modelId": "MODEL_OR_PROFILE_ID",
  "messages": [{"role": "user", "content": [{"text": "Summarize this evidence."}]}],
  "inferenceConfig": {"maxTokens": 256},
  "serviceTier": {"type": "default"}
}

default means Standard. Tier/model/API compatibility varies. A Prompt Management version ARN supplies its own documented prompt configuration. Converse contract.

Choose capacity separately from the API
Bedrock capacity and delivery choices
Option Use / constraint Cost driver
On-demand Variable live traffic; service quotas apply Model usage at the selected tier
Provisioned Throughput Eligible sustained demand; invoke provisioned ARN Model-unit capacity time, including idle capacity
Batch inference Offline S3 job; separate from StartAsyncInvoke Applicable batch model usage
Cross-Region profile Routing across approved destinations; no Provisioned Throughput Model usage at applicable profile rates
Application inference profile Usage attribution/tags; no reserved throughput Underlying inference usage
Latency-optimized (preview) Supported models/Regions; may fall back to Standard latency Rate for the latency mode actually served

Streaming changes response delivery. A profile routes inference; it does not fail over your application or cancel capacity commitments.

AWS references: Provisioned Throughput · Rates.

A cross-Region profile goes in modelId; the application stays in its source Region. Approve every possible inference destination and configure the required profile/model permissions. Routing and IAM.

Prompt controls, caching, and routing

Version prompts, evaluate changes, and inspect stopReason when output truncates. Sampling parameters change generation behavior; they do not increase the context window.

Reuse or route Implementation note
Prompt cache Reuses supported prefix processing; check model-specific checkpoints/expiry.
Application answer cache Scope keys by tenant/permissions, evidence version, model/prompt, and expiry.
Model routing Choose a supported managed pair or a measured escalation rule.

A cache hit must still pass authorization and freshness checks. Prompt caching. Pricing variants remain in the corresponding cards.

Deliver the result and preserve state

Streaming must work end to end. API Gateway response streaming uses a supported REST API integration; WebSockets support later/bidirectional messages; AppSync supplies its own subscription contract. API keys/usage plans meter usage and do not authenticate users. Streaming integrations.

Store scoped conversation/job state and idempotency keys separately from the model. DynamoDB TTL deletes asynchronously, so enforce logical expiry in the application.

For fixed intents/slots use Lex; for text-to-speech use Polly. Their cards show interface and engine choices.

Pillar · Orchestration · implementation notes

AgentCore, agent loops, and tools

AgentCore supplies modular hosting, tool connectivity, identity, memory, and policy capabilities. Choose components around the application rather than adopting every module. Components.

Runtime hosts code; Gateway connects tools; MCP defines tool interaction. Strands/Agent Squad can supply agent-loop/routing logic. Tool APIs still enforce business permissions and validate arguments.

Durable workflows and approval
Step Functions workflow types
Workflow Duration / semantics Integration boundary Cost driver
Standard Up to 1 year; exactly-once workflow model Eligible .sync jobs and callback tokens State transitions, including retries
Asynchronous Express Up to 5 minutes; at-least-once No .sync or callback tokens Requests + duration × memory
Synchronous Express Up to 5 minutes; at-most-once Caller waits; no .sync or callback tokens Requests + duration × memory

Standard suits long waits/approvals; Express suits short high-volume work. Wait states fit within each time limit. Express lacks Distributed Map/Activities. External side effects and configured retries still require idempotency.

AWS references: Workflow contracts · Step Functions rates.

Set CreateStateMachine.type to STANDARD or EXPRESS at creation; it cannot change later. Express uses StartExecution asynchronously or StartSyncExecution synchronously. Creation contract.

Propose action → authenticated approval → SendTaskSuccess/Failure
              → workflow resumes → authorized, idempotent tool action

For callback approval use Standard with a protected task token and deadline. Lambda does not need to remain running during the wait. Callback integration.

Flows, compute, and event delivery

Bedrock Flows wires supported nodes and deterministic conditions. Pass the original inputs needed downstream and explicitly route malformed classifications. Flow nodes.

Conventional Lambda invocations last up to 15 minutes. Reserved concurrency allocates/caps concurrency; Provisioned Concurrency warms environments. Neither reserves model capacity. Lambda concurrency.

S3 event → EventBridge rule → workflow
S3 event → SQS → paced worker → model/index

Enable/configure the chosen delivery path. Use filtered prefixes, bounded retries, visibility timeouts/DLQs, and idempotency to handle duplicate deliveries and avoid output-trigger loops. S3 events.

Worked sequence: maintenance diagnosis and approved mutation

Follow diagnosis → approval → authorized mutation:

Production industrial maintenance agent using Amazon Bedrock AgentCore
🏭 Production AgentCore sequence: diagnose freely, mutate only with approval

The maintenance API must enforce the engineer’s plant-level permissions and reconcile retries. A conversational memory is not an asset record, and an agent must not bypass industrial safety controls.

Pillar · Security / governance · implementation notes

Identity guides: Choose the access path · Protocols and tokens · Trust and authorization.

Private paths and data permissions

Bedrock model calls use the bedrock-runtime interface endpoint. Configure DNS, network access, and IAM/endpoint policies; a private route does not itself authorize the request. Lake Formation permissions apply through integrated engines. Bedrock PrivateLink.

Safe content and redaction

Guardrails evaluates selected content policies; the application uses the returned block/mask action. Document and tool permissions remain separate. Coverage varies by policy/input type. Guardrails.

Extract → detect sensitive spans → apply/verify redaction
        → sanitized prompt, index, and log destinations

Macie discovers sensitive data in eligible S3 objects. Findings do not redact files; unsupported or unreadable objects need another path. Macie coverage.

Retention, keys, and credentials

Set access, deletion, retention, and location rules for every copy: source, chunks/vectors, state, caches, and logs. Object Lock protects retained versions; Lifecycle manages transitions/expiry.

KMS manages encryption keys; Secrets Manager stores/rotates credentials. Neither replaces application authorization. KMS and secret options.

Pillar · Evaluation & observability · implementation notes

Evaluate before promotion

Version the test set, prompt/model configuration, and candidate outputs. Evaluate retrieval separately from the answer, compare important cohorts with the baseline, then apply an explicit promote/halt gate.

Question Useful evaluation signal
Did retrieval find relevant evidence? Context relevance / evidence coverage
Are claims supported by that evidence? Faithfulness
Does the answer address the task correctly? Correctness / completeness; references as required
Does it fit a subjective style or persona? Human comparison with a shared rubric

A faithful answer can repeat an incorrect source. Job completion means evaluation finished; inspect the report and thresholds. Evaluation setup, RAG metrics.

Correlate runtime evidence

Use shared request/version IDs across application, retrieval, model, and tools so their records can be investigated together.

Illustrative invocation-log excerpt:

{
  "operation": "Converse",
  "modelId": "MODEL_ID",
  "input": {"inputTokenCount": 120},
  "output": {"outputTokenCount": 35}
}

Invocation logging is opt-in. Configure supported destinations, sensitive-content access, and retention before capture. Log configuration and schema.

AgentCore telemetry needs its documented setup; instrument application/tool calls as needed. Traces help explain execution but do not expose all hidden model reasoning. AgentCore observability.

CloudTrail records supported API activity. Correlate it with application/source IDs when you need to know which evidence a user received. Data-event coverage.

Human review and model governance

Ground Truth creates training labels; A2I routes predictions for review. Model Cards document intended use/limits; Clarify supports bias/explanations; Model Monitor checks configured baselines. Review and drift findings require an explicit application/release response. Check the availability notices in these cards.

Explore AWS versus customer responsibilities and evidence paths in the security/audit guide.

Audit Manager has restrictions on new setup; follow its availability guidance. Evidence collection supports an audit; the customer still selects controls and resolves findings.

Packaged apps · implementation notes

Product fit and identity

Quick supplies a packaged workforce experience. Check its connectors, source permissions, and governance needs against your workflow. Q Business has existing-customer restrictions. User subscriptions and search/index capacity can be separate charges; their cards compare the plans.

Developer assistance

Q Developer supports eligible development, review, and transformation workflows. Grant repository access deliberately and verify generated changes. IDE, repository integrations, and transformation have different feature/lifecycle contracts. Capabilities and lifecycle.

    Use when

    Boundary

    Compare alternatives →Implementation notes →AWS documentation ↗

    ← → browse cards · Esc closes

    References and practice

    Cards and guides link to AWS for current contracts, limits, availability, and rates. Capacity comparisons include Bedrock tiers, SageMaker hosting/GPU support, and Step Functions modes. Reviewed 22 October 2026.

    Study sequence: Infrastructure and evaluation → AWS AI Services → AIP-C01 architecture and practice. AWS’s exam scope defines certification coverage.

    ×
    Contents