Product and intended use
Define the configuration, people, information and tasks being assessed.
What is inside the service and what is billed separately
Not confirmed
The vendor FAQ (read 2026-09-27) separates serverless foundation models from Amazon Bedrock Marketplace, which it describes as offering 'over 100 popular, emerging, or specialized models' deployed to managed SageMaker endpoints after accepting the provider's EULA and price. Certain serverless and Marketplace models are billed through AWS Marketplace because they are sold by third-party providers as 'Third-Party Content', as described in AWS Service Terms section 50.12. Custom Model Import, fine-tuning, continued pre-training, AgentCore, Managed Agents powered by OpenAI, Data Automation, Guardrails and Knowledge Bases are each separate capabilities.
Ask: For each model we would call, is it a serverless model sold by AWS or a third-party model sold through AWS Marketplace, and which separate terms and prices attach to it?
Cloud service in a Region the customer selects
Public claim only
Section 1.4 of the AWS Customer Agreement (read 2026-09-27) provides that the customer may specify the AWS regions in which Your Content will be stored and consents to storage and transfer into the regions selected, and that AWS will not move Your Content from the selected regions except as necessary to comply with the law or a binding order of a governmental body. The vendor FAQ adds that customer content processed by Bedrock is encrypted and stored at rest in the Region where Bedrock is used. Private connectivity from the customer's VPC is available through AWS PrivateLink.
Ask: Which AWS Region will our Bedrock resource run in, and will PrivateLink be used so that traffic does not traverse the public internet?
Named components of the service
Public claim only
From the vendor's own pages (read 2026-09-27): access to foundation models with evaluation tools; AgentCore for deploying agents using any framework and model; Managed Agents powered by OpenAI; Knowledge Bases, Bedrock Data Automation, prompt engineering and fine-tuning for customisation; Guardrails with content filters, denied topics, word filters, contextual grounding checks and Automated Reasoning checks; and Model Distillation, prompt caching, Intelligent Prompt Routing, real-time and batch processing. Guardrails has a Standard tier that 'requires opting into cross-region inference' and a Classic tier limited to three languages.
Ask: Which of these components would be switched on for us, and does any of them require cross-region inference?
Region choice, and what is not established about Australia
Public claim only
AWS publishes that a customer in Australia that wants to store data only in Australia can deploy exclusively in the Asia Pacific (Sydney) Region (Data Privacy FAQs, read 2026-09-27), and Section 1.4 of the Customer Agreement binds AWS not to move content out of the selected regions except for legal compulsion. What is not established for Bedrock: the Bedrock FAQ answers 'In which AWS Regions is Amazon Bedrock available?' only by linking to an endpoints-and-quotas document that was not read within the credit cap, and names Asia Pacific (Sydney) availability for Amazon Bedrock Data Automation alone. Some features are described as requiring or using cross-region inference, and one capability's availability is given as 'The US East (Ohio) Region via cross-region inference'.
Ask: Is every model and feature we would use available in Asia Pacific (Sydney), and can cross-region inference be left off so that inference does not leave Australia?
What the vendor says the service is for
Public claim only
The product page headline (read 2026-09-27) is 'Amazon Bedrock - The platform for building generative AI applications and agents at production scale'. The vendor's listed uses include summarising 'long documents such as articles, reports, research papers, technical documentation, and even books', building assistants that break down tasks and take actions, and workflow automation. No professional-services or legal-practice use is named.
Ask: Does AWS place any restriction or additional term on use of Bedrock outputs in regulated professional advice?
Check for vendor content directing how AI describes the product
Public claim only
Checked deliberately on 2026-09-27. No content addressed to AI models, assistants or LLMs telling them how to describe Amazon Bedrock was found. https://aws.amazon.com/llms.txt, /ai-info/ and /ai.txt each returned 404; https://aws.amazon.com/robots.txt returned 200 with User-agent groups for '*', 'AdsBot-Google' and 'AdsBot-Google-Mobile' only, so it carries no AI-crawler allow or disallow directives. The scraped product, FAQ and security pages contain no block addressed to AI. The pages do carry a reader-facing line, 'Need more info? Highlight any text to get an explanation generated with AWS generative AI', which is a site feature for human readers.
Ask: Does AWS publish any guidance or machine-readable file telling AI assistants how to describe Amazon Bedrock, and where?
Vendor comparative claims inside its own FAQ
Public claim only
The vendor's own FAQ page (read 2026-09-27) answers the question 'What is Bedrock Data Automation?' with, among other things, 'Bedrock Data Automation offers industry-leading accuracy at lower cost than alternative solutions, along with features such as visual grounding with confidence scores for explainability and built-in hallucination mitigation.' The same page states that Guardrails 'delivers industry-leading safety protections for your generative AI applications' and that AgentCore provides 'industry-leading execution time, payload size, and complete session isolation'. The product page states that 'Amazon Bedrock provides industry-leading security, privacy, and compliance for generative AI applications'. These are the vendor's comparative claims about itself in its own published material, recorded here as such and not adopted; no supporting method or comparison set is published on those pages.
Ask: What measurement and comparison set support the 'industry-leading' accuracy, cost, safety and execution-time claims on the Bedrock FAQ and product pages?
Data, controls and requirements
Compare the actual configuration with firm, client and jurisdiction requirements, supported by evidence.
Whatever the firm's application sends is client material
Not confirmed
Prompts, supplemental content and responses are Your Content under the AWS Customer Agreement, and Section 1.4 binds AWS not to access or use Your Content except as necessary to maintain or provide the Services or to comply with law or a binding governmental order. The vendor also applies automated abuse detection mechanisms described on a documentation page that was not read. What reaches Bedrock is entirely determined by the application the firm builds, so the authority to send client material is a decision for the firm, not a feature of the service.
Ask: Which client matter content would our application place in prompts or Knowledge Bases, and under what client authority?
Models named by the vendor, and the list not read
Public claim only
Vendor pages read 2026-09-27 name Amazon Nova and Amazon Titan, Anthropic's Claude (in the latency-optimised inference answer), Llama 3.1 70B and 405B, Llama 2/3, Mistral and Flan architectures for Custom Model Import, and OpenAI for 'Amazon Bedrock Managed Agents, powered by OpenAI'. The product page says only 'hundreds of FMs from leading AI companies' without enumerating them; the enumerated list sits at aws.amazon.com/bedrock/model-choice/, which was not read within the credit cap. The security page states that when a model is tuned, AWS bases it on a private copy, 'your data is not shared with model providers, and is not used to improve the base models'.
Ask: For each model we would call, who is the provider, is it sold by AWS or by that provider through Marketplace, and does the no-sharing statement cover it?
Published AWS sub-processor list; Bedrock not in the service-improvement table
Public claim only
The AWS Sub-processors page (Last Updated 28 July 2026, read 2026-09-27) is a standing published list engaged under the AWS Data Processing Addendum, in four parts: AWS infrastructure entities by Region (including 'Amazon Corporate Services Pty, Ltd', Australia, for Asia Pacific (Sydney)); AWS entities supporting specific services; contracted third parties; and AWS European Sovereign Cloud entities. AWS states it will update the page at least 30 days before engaging a new sub-processor and will notify subscribers by email. Amazon Bedrock does not appear in the service-improvement table or among the third-party service providers on that page; no third-party model provider is listed as a Bedrock sub-processor.
Ask: Confirm in writing that no model provider is a sub-processor for the Bedrock models we would call, and subscribe us to sub-processor change notifications.
No training on inputs or outputs
Public claim only
The vendor FAQ (read 2026-09-27) answers 'Will AWS and third-party model providers use customer inputs to or outputs from Amazon Bedrock to train Amazon Nova, Amazon Titan or any third-party models?' with 'No, AWS and the third-party model providers will not use any inputs to or outputs from Amazon Bedrock to train Amazon Nova, Amazon Titan, or any third-party models.' The security page states that tuning is done on a private copy of the model, so data is not shared with model providers and is not used to improve the base models. Corroborating but not contractual: Amazon Bedrock does not appear in the published sub-processors service-improvement table, which lists the services for which AWS development entities process customer data unless the customer opts out. The AWS Service Terms section 50 that would make this contractual was not read within the credit cap.
Ask: Point us to the clause in the AWS Service Terms that makes the no-training statement contractual for Bedrock, and confirm we have not opted in to any service-improvement use.
Abuse detection and customer-run evaluation, not product feedback
Public claim only
The security page states that to prevent potential misuse 'Amazon Bedrock implements automated abuse detection mechanisms', linking to a documentation page that was not read, so what is sampled, stored or human-reviewed is not established from the pages read. Human feedback on model responses exists only inside Model Evaluation, which the FAQ describes as workflows the customer sets up using its own employees or an AWS-managed team, where reviewers give thumbs up or down, rate on a 1-5 scale, choose between multiple responses or rank prompts. No product-feedback channel that would send prompts to AWS was found on the pages read.
Ask: What does automated abuse detection store for Bedrock, for how long, in which Region, and can any AWS person read a flagged prompt?
At rest in the Region used; logging is opt-in
Public claim only
The vendor FAQ states 'Any customer content processed by Amazon Bedrock is encrypted and stored at rest in the AWS Region where you are using Amazon Bedrock' and that customised models remain in the Region where the API call is processed. The security page says the customer can choose to store the metadata, requests and responses in its own S3 bucket and in CloudWatch Logs, so that record is the customer's. No retention period for anything Bedrock itself holds is published on the pages read.
Ask: What does AWS retain for a Bedrock invocation when we do not enable model invocation logging, and for how long?
Termination effect, not a service deletion promise
Public claim only
Section 5.3 of the AWS Customer Agreement (read 2026-09-27) provides that on the Termination Date all rights terminate and the customer must return or destroy all AWS Content it holds, and that unless AWS terminated for cause, during the 30 days following the Termination Date AWS 'will not take action to remove from the AWS systems any of Your Content' and will allow retrieval if all amounts due are paid. The agreement read contains no separate commitment on how quickly Your Content is deleted after that window, and the AWS Data Processing Addendum was not read within the credit cap.
Ask: After the 30-day post-termination window, within what period is Your Content deleted from AWS systems and backups, and is that commitment in the AWS DPA?
Contractual limit on AWS access to content
Public claim only
Section 1.4 of the AWS Customer Agreement states 'We will not access or use Your Content except as necessary to maintain or provide the Services, or as necessary to comply with the law or a binding order of a governmental body', and that AWS will not disclose Your Content to any government or third party except for such legal compulsion, with notice to the customer unless prohibited. The Data Privacy FAQs add that AWS will attempt to redirect a governmental demand to the customer and will give reasonable notice to allow a protective order to be sought. What abuse detection may expose to an AWS person for Bedrock specifically was not established.
Ask: Which AWS roles can read a Bedrock prompt or completion in the course of maintaining or providing the service, and is that access logged to us?
Customer-configured identity and network controls
Public claim only
The security page states that identity-based policies control what actions users and roles can perform, on which resources and under what conditions, and that PrivateLink can give private connectivity from the customer's VPC without exposing it to internet traffic. The Data Privacy FAQs put configuration of access to services and resources on the customer, naming IAM, AWS Organizations and CloudTrail, and the Customer Agreement Section 2.3 makes the customer responsible for properly configuring and securing the service. Section 2.1 makes the customer responsible for all activity under its account.
Ask: Which IAM roles will be able to call Bedrock, and will access be restricted to a private endpoint?
In transit and at rest, with optional customer keys
Public claim only
The security page states data is encrypted in transit and at rest and that the customer can create, manage and control encryption keys using AWS Key Management Service. The FAQ adds that when fine-tuning, data 'is never exposed to the public internet, never leaves the AWS network, is securely transferred through your VPC, and is encrypted in transit and at rest'. Contractually, Section 1.3 of the Customer Agreement commits AWS to 'reasonable and appropriate measures designed to help you secure Your Content', and Section 2.3 places encryption choices on the customer.
Ask: Will Bedrock resources use a customer-managed KMS key, and who holds and rotates it?
Certifications claimed for Bedrock
Public claim only
The vendor FAQ (read 2026-09-27) states Amazon Bedrock is in scope for FedRAMP Moderate, SOC, ISO and HIPAA eligibility and can be used in compliance with the GDPR; that it is included in the SOC 1, 2 and 3 reports; that it is one of the AWS services under ISO compliance for ISO 9001, 27001, 27017, 27018, 27701, 22301 and 20000; and that it is CSA STAR Level 2 certified. The security page adds that Bedrock is a FedRAMP High authorised service in the AWS GovCloud (US-West) Region only. Certificate numbers and audit scope are not on these pages; the Data Privacy FAQs say SOC 2 Type II reports are downloaded through AWS Artifact.
Ask: Provide the current SOC 2 Type II report and ISO certificates through AWS Artifact showing Amazon Bedrock and the Asia Pacific (Sydney) Region inside the audited scope.
Australian contracting party, New South Wales law, ACICA arbitration
Public claim only
The AWS Customer Agreement (last modified 14 August 2026, read 2026-09-27) is between the customer and the AWS Contracting Party determined by Account Country. For Australia the table names 'Amazon Web Services Australia Pty Ltd (ABN: 63 605 345 891)', Level 37, 2-26 Park Street, Sydney, NSW, 2000. For that party the Governing Laws are the laws of New South Wales and the Governing Courts the courts of New South Wales; Section 11.5(d) sends disputes to ACICA arbitration seated in Sydney before three arbitrators, with the existence of the proceedings confidential; Section 11.15(a) adds Australian Consumer Law wording limiting remedies for breach of statutory guarantees to resupply or the cost of resupply. If no location information has been provided, the contracting party is Amazon Web Services, Inc.
Ask: Confirm our Account Country is Australia so that Amazon Web Services Australia Pty Ltd is the contracting party, and that Bedrock use is inside that agreement rather than a US-entity account.
Region selection binds AWS, subject to legal compulsion
Public claim only
Section 1.4 of the Customer Agreement provides that the customer specifies the regions in which Your Content will be stored, consents to storage and transfer into those regions, and that AWS will not move Your Content from the selected regions except as necessary to comply with the law or a binding governmental order, with notice unless prohibited. The Data Privacy FAQs repeat this and add the exception 'except as necessary to provide the services you initiated'. Against that, Bedrock features described as using cross-region inference can process outside the chosen Region, and the sub-processor list shows processing locations spanning many countries.
Ask: Does 'necessary to provide the services you initiated' cover cross-region inference for Bedrock, and can we contractually prohibit inference outside Australia?
No breach-notification clause in the agreement read
Not confirmed
The AWS Customer Agreement read on 2026-09-27 contains a security commitment (Section 1.3) and a notice provision for legal demands (Section 1.4) but no security-incident notification obligation or timeframe. The AWS Data Processing Addendum, which the sub-processors page names as the instrument under which sub-processors are engaged, was not read within the credit cap and no URL for it was captured from the pages read.
Ask: Where in the AWS DPA is the security-incident notification obligation for Bedrock, what triggers it, and within what period would we be notified?
Notice of service and agreement changes
Public claim only
Section 1.5 of the Customer Agreement provides at least 12 months' prior notice before discontinuing a material functionality of a generally available Service the customer is using, with exceptions for emergencies, third-party intellectual-property claims and legal compliance. Section 1.6 gives at least 90 days' advance notice for adverse changes to any Service Level Agreement. Section 10 allows AWS to modify the agreement at any time by posting a revised version, effective on posting or as stated in a notification email, with continued use constituting agreement. The sub-processors page separately promises at least 30 days before a new sub-processor is engaged.
Ask: How would we be told that a Bedrock model we depend on is being retired, and does the 12-month notice apply to individual model versions as well as to the service?
Thirty-day retrieval window after termination
Public claim only
Section 5.2 lets either party terminate for convenience, the customer by notice and account closure and AWS on at least 30 days' notice; AWS may terminate immediately in the circumstances listed in Section 5.2(b)(ii), including if a third-party technology relationship ends or to comply with law. Section 5.3(b) provides that unless AWS terminated for cause, for 30 days after the Termination Date AWS will not remove Your Content and will allow retrieval provided all amounts due are paid. Nothing read commits AWS to export customised models or Knowledge Base indexes in a portable form.
Ask: On exit, what exactly can we export - prompts, logs, Knowledge Base source data, fine-tuned model weights - and in what format?
Knowledge Bases ingestion sources
Public claim only
The vendor FAQ (read 2026-09-27) states content can be ingested into Amazon Bedrock Knowledge Bases from the web, Amazon S3, Confluence (preview), Salesforce (preview) and SharePoint (preview), with programmatic or streaming ingestion for unsupported sources, plus structured sources such as a Redshift data warehouse and the AWS Glue data catalogue. AgentCore is described as having native support for the Model Context Protocol 'for connection to thousands of tools'. Preview connectors sit under AWS preview terms that were not read.
Ask: Which connectors would be enabled, are any of them still in preview, and what permission model governs what they index?
Web ingestion and a built-in browser tool
Public claim only
The vendor FAQ lists the web among the sources a Knowledge Base can ingest from, and describes AgentCore as providing 'an enhanced code interpreter tool, built-in browser tool' among its upgraded tools. No statement was found on the pages read about how web content is selected, cached or attributed, or about whether web access can be disabled for an agent.
Ask: Can web crawling for Knowledge Bases and the AgentCore browser tool be disabled entirely, and if not, how are fetched pages logged?
Agents that take actions, and configurable safeguards
Public claim only
The product page describes agents that 'break down tasks and take actions' and AgentCore as the platform to build, connect and optimise agents with tracing, debugging, evaluation, identity, memory and observability. The FAQ describes Guardrails content filters, denied topics, word filters, contextual grounding checks and Automated Reasoning checks, and an InvokeGuardrailChecks API aimed at agentic applications that can run in detect-only mode returning numeric scores so the application decides whether to block, bypass, route to human review or log. All of that is configuration the firm performs.
Ask: For any agent we deploy, which actions can it take without a human approval step, and what guardrail thresholds and logging would be set?
No human review in the service; the firm supplies it
Not confirmed
The vendor FAQ describes human review only as part of Model Evaluation, a workflow the customer configures with its own employees or an AWS-managed expert team to rate and rank model responses, and as an option the application may choose when a guardrail runs in detect-only mode. The vendor also warns, in effect, that Automated Reasoning checks 'require upfront involvement from a domain expert to create a Policy'. Nothing in the service reviews output before it reaches a user; that step must be designed by the firm.
Ask: Who inside the firm checks Bedrock output before it is used in advice or filed material, and how is that check evidenced?
