What Is Amazon Bedrock? Models, Pricing and Guardrails

Amazon Bedrock is a fully managed AWS service that lets you build generative AI applications using foundation models from different providers through APIs. You can add text generation, summarization and question answering to an application without training a model or managing the servers that run it.

This guide follows a request from your application to a model, explains the data boundary, and compares token pricing, service tiers, batch inference and Provisioned Throughput. It also covers the surrounding services, Knowledge Bases, Guardrails, customization and AgentCore, then works through the distinctions you need for AI Practitioner practice questions. The whiteboard video at the end draws these connections as an application takes shape.

What is Amazon Bedrock?

A foundation model is a large model that can support generative AI tasks such as writing, summarizing and answering questions. Bedrock gives your application access to those models as a managed service. You choose the model and send requests; AWS operates the model hosting environment.

AWS lists more than 100 foundation models, including Amazon Nova, Anthropic Claude, DeepSeek, Kimi from Moonshot AI, MiniMax, OpenAI and xAI. That choice lets you compare models for your task without building a separate hosting arrangement for each provider. The Bedrock overview describes the service and its model families.

Think of the service boundary as a division of work. Bedrock handles access to the hosted models, while your application still chooses the prompt, the information supplied to the model and the controls around the response. A managed model API does not make those application decisions for you.

How a request reaches a model

The request path explains where permissions, model selection and streaming fit. For a new application, AWS recommends the Regional bedrock-runtime endpoint, whose address follows bedrock-runtime.{region}.amazonaws.com.

1. Your application prepares the request. It selects a model and supplies the prompt through an API such as Converse or InvokeModel.
2. The caller authenticates. Calls can use IAM credentials with request signing or a Bedrock API key. The principal still needs the relevant permission, such as bedrock:InvokeModel.
3. Bedrock runs the selected model. The model is hosted in an AWS-operated deployment account that its provider cannot access.
4. The response returns to the application. You can receive the completed answer or use a streaming operation such as ConverseStream to receive it as it is generated.

The endpoint documentation explains the supported interfaces. Authentication and authorization belong in this path even when the application uses a convenient API key rather than signing each request itself.

Converse API versus InvokeModel

Converse provides a consistent request interface across models that support messages. InvokeModel exposes model-specific request and response formats, giving you more direct control. The difference matters when you want to compare providers without rebuilding the application's request handling.

Converse and ConverseStream also support tool use and Guardrails, while model-specific settings can be passed in a separate structure. Changing the model identifier can therefore be a small code change, but you should still evaluate the resulting answers for your task. The Converse documentation describes the shared interface and its model-specific options.

Model access on first use

In commercial Regions, most models are enabled when you first invoke them, without a separate access request. Third-party Marketplace models still have subscription permissions to satisfy, including aws-marketplace:Subscribe, aws-marketplace:Unsubscribe and aws-marketplace:ViewSubscriptions. For Anthropic models on the runtime endpoint, there is also a first-time-use form.

Automatic activation does not remove IAM authorization. When troubleshooting access, check the caller permissions as well as the provider prerequisites described in the model access documentation. An enabled model and a caller permitted to invoke it are separate conditions.

What happens to your data

AWS operates the accounts where Bedrock deploys provider models. The providers have no access to those accounts and cannot see the prompts, completions or Bedrock logs there. This boundary is described in the data protection documentation.

AWS also says your content is not shared with model providers or used to improve the base models. Its Bedrock FAQ states that AWS and third-party providers do not use Bedrock inputs or outputs to train their models. Fine-tuning produces a private customized copy rather than changing the shared base model.

Keep that provider boundary separate from the controls inside your own application. If you enable full invocation logging, you are deliberately creating records of prompts and responses in your logging destinations. If you need to mask personal information in a conversation, you configure content controls such as Guardrails; the provider's lack of access does not perform that masking.

How Bedrock pricing works

For on-demand text inference, you pay separately for input tokens and output tokens. Tokens are words or pieces of words processed by the model, so both a longer prompt and a longer answer increase usage. Rates vary by model and Region; there is no single Bedrock price per conversation.

Start a cost estimate with the material you send and the responses you expect. Adding the same long document to every request repeatedly adds input tokens, even if the number of users stays unchanged. The Bedrock pricing page supplies the rates and distinguishes the purchasing options below.

Service tiers: response speed and reserved token capacity

Bedrock has Reserved, Priority, Standard and Flex service tiers. Standard is the default when the request omits service_tier; Priority favors faster responses, and Flex accepts longer processing times for a lower price. For third-party providers such as OpenAI, DeepSeek and Mistral AI, the pricing page lists Priority at a 75% premium and Flex at a 50% discount to Standard. Check the rates for your own model.

The Reserved tier reserves tokens-per-minute capacity for a month or three months, with overflow going to Standard. Access is arranged through the AWS account team. Its reservation uses a different capacity model from Provisioned Throughput, so keep their names and terms separate when reading the service tier documentation.

Batch inference: files in, files out

With batch inference, you place prompts in files in Amazon S3, submit a job, and collect the output files from S3 after processing finishes. It suits work where the application can wait for a set of results instead of keeping a user waiting for each response. AWS prices batch inference 50% below on-demand for supported models; that discount does not apply to every model.

Batch is a job submission approach, while Flex is a service tier for inference requests. Their discounts do not make them interchangeable application designs. Also, batch inference is not supported for provisioned models, as the batch documentation explains.

Provisioned Throughput: dedicated capacity billed hourly

Provisioned Throughput purchases dedicated capacity measured in Model Units at a fixed hourly cost. The commitment choices are no commitment, a month or six months, with longer commitments receiving a lower hourly price. Billing continues until you delete the provisioned capacity, so a quiet application does not by itself stop that charge.

For custom-model inference, Provisioned Throughput is the classic exam answer, but it is not a universal requirement. AWS also documents on-demand custom deployment for a limited set of models and Regions. Read the Provisioned Throughput guide alongside the custom on-demand deployment options before treating either route as available for your particular model. Compare the choices by the application requirement:

• Standard: ordinary inference requests at the default tier / Priority: faster responses for a pricing premium.
• Flex: requests that can tolerate more processing time / Batch: asynchronous jobs with input and output files in S3.
• Reserved tier: a reservation expressed in tokens per minute / Provisioned Throughput: dedicated capacity expressed in Model Units and billed hourly.

Cross-Region inference

An inference profile identifies a model and the Regions to which Bedrock may route a request. A geographic profile keeps processing within a geography such as the US or EU. A global profile allows processing in any supported commercial Region.

Cross-Region traffic stays on the AWS network, is encrypted in transit, and has no extra routing charge. That does not make inference free: model usage remains billable. Cross-Region inference profiles currently do not support Provisioned Throughput, so you cannot assume that those capacity options combine.

Choose the processing boundary deliberately. If the requirement is geographic data residency, an encrypted connection alone does not tell you where the model processes the request. The cross-Region inference guide explains the distinction between geographic and global profiles.

Who uses Bedrock

AWS's DoorDash case study reports a 50% reduction in generative AI application development time for its Bedrock-based solution. It also describes quick access to the models the team needed. This illustrates the value of managed model access when the immediate task is building an application.

An AWS account of Adobe's developer support system reports a 20% increase in retrieval accuracy using Bedrock Knowledge Bases, supporting thousands of developers. That is a retrieval result for the described implementation, not a guarantee that every generated answer becomes more accurate by the same amount. Treat both customer figures as reported outcomes for those projects.

Services Bedrock works with

API Gateway and Lambda around the model

A common application path puts Amazon API Gateway in front of AWS Lambda, with Lambda preparing the prompt and calling Bedrock. To stream the answer, AWS points to API Gateway WebSocket APIs, or to Lambda response streaming if you don't need an API layer. It describes these patterns in its generative AI architecture guidance.

This gives each component a clear job: the API receives the application request, the function runs application logic, and Bedrock performs model inference. When investigating a failure, it helps to locate which part of that path failed before changing model settings.

S3 and vector stores

S3 holds batch input and output files and the training data used for fine-tuning. For a customization job, the service role needs appropriate permissions to read training and validation data and write outputs. Those storage permissions are separate from permission to invoke a model.

Knowledge Bases uses a vector store for embeddings. Supported choices include OpenSearch Serverless, S3 Vectors and Aurora, among others. The vector store setup guide describes S3 Vectors as a cost-effective option for infrequent queries, so the access pattern belongs in the storage decision.

PrivateLink, CloudWatch Logs and CloudTrail

An AWS PrivateLink interface endpoint gives your VPC private access to Bedrock without requiring an internet gateway, NAT, VPN or Direct Connect. Use the endpoint appropriate to the operation, such as bedrock-runtime for model inference. The PrivateLink documentation describes these endpoints.

For visibility, distinguish API activity from conversation content. CloudTrail records InvokeModel and Converse as management events by default, while model invocation logging is off by default. Enabling invocation logging sends full request and response data to CloudWatch Logs, S3 or both; see the invocation logging documentation and CloudTrail integration.

Bedrock versus SageMaker AI

Bedrock is the managed, API-driven route for application builders using foundation models. SageMaker AI serves data scientists and ML engineers who want to build, train and deploy models with more infrastructure and framework control. Bedrock also supports customization, so the distinction is the operating model and level of control, rather than whether customization exists at all.

If the requirement emphasizes trying hosted foundation models through a common API, Bedrock matches that requirement. If it emphasizes controlling the training and hosting environment, SageMaker AI is the relevant platform to examine. AWS discusses their roles in the Bedrock FAQ.

Features to remember

Model choice and inference controls

Converse makes it easier to compare supported models, but inference settings still depend on the model. Lower temperature makes token selection more deterministic; higher temperature makes it more random. Maximum output tokens caps response length, while stop sequences end generation when the model emits them.

Top K limits the number of likely tokens considered, while Top P uses cumulative probability and therefore allows a varying candidate pool. Defaults and supported ranges differ by model. Use the inference parameter guide when tuning a particular model rather than carrying settings across unchanged.

Customization changes model behavior

Bedrock lists supervised fine-tuning, reinforcement fine-tuning and distillation as customization methods. Supervised fine-tuning learns from labeled examples and changes model parameters. Reinforcement fine-tuning uses reward functions that you define with Lambda.

Distillation transfers knowledge from a larger teacher model to a smaller student, aiming for a faster, lower-cost model. Customization also has costs beyond ordinary inference: training is billed on processed training tokens across epochs, with storage charged per custom model. The customization guide describes these methods.

Knowledge Bases adds retrieved information

Amazon Bedrock Knowledge Bases provides managed retrieval-augmented generation, or RAG. It retrieves relevant material from your data, supplies that material to a model, and supports answers with citations. The model's parameters remain unchanged; the retrieved information becomes context for the request.

This distinction matters when your problem is access to changing documents rather than learned response behavior. The RAG introduction explains the retrieval path, and RAG versus fine-tuning compares those decisions in depth. The official Knowledge Bases guide covers the managed implementation.

Guardrails checks prompts and responses

Bedrock Guardrails evaluates both user inputs and model responses. You select controls according to the problem: content filters for harmful content and prompt attacks, denied topics for subjects outside the application's scope, and word filters for specified terms. Sensitive information filters can block or mask personally identifiable information and custom patterns.

Contextual grounding checks assess whether an answer is grounded in its source and relevant to the query. Automated Reasoning checks validate answers against logical rules. These checks help detect problems; do not read them as a promise that every response is correct.

You can attach a guardrail at inference using its identifier and version. You can also use ApplyGuardrail to evaluate text independently of a model invocation. The Guardrails guide describes the controls and their use.

AgentCore supports agent applications

Amazon Bedrock AgentCore is the platform for building, deploying and operating agents with any framework and model. Its services include Runtime, Memory, Gateway, Identity and Observability. Supported frameworks include CrewAI, LangGraph, LlamaIndex and Strands Agents; the AgentCore overview describes the platform and its consumption pricing.

Be careful with older tutorials: Bedrock Agents is now Agents Classic, which is closed to new customers. AWS directs new agent work toward AgentCore. That closure applies to Agents Classic; the maintenance notice says Bedrock models, Knowledge Bases and Guardrails remain available.

Evaluation, Prompt Management and Flows

Bedrock model evaluation supports automatic jobs, human reviewers and LLM-as-a-judge evaluation, as well as RAG evaluations for knowledge bases. These let you assess a choice of model or retrieval setup instead of relying on an appealing sample answer. See the evaluation guide for the available approaches.

Prompt Management saves, versions and compares prompt variants for reuse. Flows links prompts, models, knowledge bases and Lambda into visual workflows, with immutable versions and aliases that route traffic. The Prompt Management documentation and Flows guide explain these application-building features.

Bedrock exam traps

For the AWS Certified AI Practitioner exam, Bedrock is a core service to understand. Domain 3, Applications of Foundation Models, accounts for 28% and names Knowledge Bases, Prompt Management and Model Evaluation. The official domain outline helps you connect the feature names to the decisions below.

Recognizing the service requirement

Look for the requirement to use foundation models through APIs without managing model-hosting infrastructure. That points to Bedrock, while requirements for infrastructure and framework control point toward SageMaker AI. A practice question on choosing managed foundation model access tests that boundary without requiring you to memorize a particular model family.

Access control versus content control

IAM determines who may call the model; Guardrails determines what content is permitted. In a practice question on chatbot safeguards and personal data, the combination to recognize is a denied topic plus sensitive information filters. Encryption protects data, and audit logging records activity, but neither performs those conversation filtering jobs.

Do not assume the model must be hosted by Bedrock for the guardrail to be useful. A practice question on applying an existing guardrail to another model tests the independent ApplyGuardrail API. The application sends the text for evaluation without needing to replace its existing model hosting.

Retrieved knowledge versus changed parameters

Changing documents and a requirement for citations point toward retrieval. Fine-tuning changes model parameters, while Knowledge Bases supplies retrieved context without changing them. A practice question on frequently updated internal policies asks you to connect that difference to an application's information needs.

Privacy is another separate distinction. A practice question on Bedrock customization data checks whether you understand that customization creates a private model rather than training the shared base model. Keep the model's ownership boundary separate from the question of whether you need retrieval or fine-tuning.

Token usage versus purchased capacity

An unchanged request count can still produce a larger on-demand text inference bill if the prompts or answers grow. A practice question on input-token costs tests that relationship. Read the amount of text sent on each call before looking for a change in user count.

For steady traffic with a fixed hourly capacity requirement, recognize Provisioned Throughput. A practice question on purchasing dedicated throughput ties that requirement to Model Units and a commitment. Remember both qualifications: capacity continues to bill until deleted, and custom-model inference has limited on-demand alternatives.

API audit records versus full prompt logs

CloudTrail recording an API call does not mean full conversation logging was enabled. A practice question on recording model prompts and responses requires model invocation logging to CloudWatch Logs or S3. Guardrails filtering is a different requirement again: a control that masks text does not replace the requested audit record.

Continue with the AI Practitioner practice questions to test these choices in context. For a deeper application-building exam path, the Generative AI Developer Professional guide explains the certification where Bedrock appears across the domains.

Frequently asked questions

What is Amazon Bedrock used for?

Bedrock lets applications use foundation models for generation, summarization and question answering without managing model-hosting servers. Knowledge Bases adds retrieved company information, Guardrails adds content checks, and AgentCore supports agent applications.

Does Bedrock use my prompts to train models?

AWS says Bedrock inputs and outputs are not used to train AWS or third-party models. Content is not shared with model providers, and fine-tuning creates a private customized copy rather than updating the shared base model.

How is Amazon Bedrock priced?

On-demand text inference charges separately for input and output tokens at model- and Region-specific rates. Service tiers change the price and processing tradeoff, batch uses asynchronous jobs, and Provisioned Throughput charges hourly for dedicated capacity.

What is the difference between Bedrock and SageMaker AI?

Bedrock provides managed foundation model access through APIs, with customization options. SageMaker AI provides more control over building, training and deploying models, including infrastructure and framework choices.

Do I need to request model access first?

Most models in commercial Regions are enabled on first use without a separate access request. You still need invocation permissions and any applicable Marketplace prerequisites; Anthropic models on the runtime endpoint also require the first-time-use form.

Watch the whiteboard video

The whiteboard builds the application around a moving request, making the deployment account, network boundary and content checks easier to locate together. Watch Amazon Bedrock Explained: Models, Guardrails, Knowledge Bases and More on YouTube.