Cloud platform Managed only Proprietary

Amazon Bedrock

Name: Amazon Bedrock
Author: Amazon Web Services

AWS-managed service for calling foundation models from 19 model providers through one AWS API.

Built by Amazon Web Services · US company

Compare with others Estimate cost Visit site ↗

Access at a glance

Whether this product can work for you at all, before features matter: who pays the model bill, where it can run, and which of your existing API calls keep working. Every value is the vendor’s own claim, linked to the page it came from.

AWS calls Bedrock "a fully managed service that provides secure, enterprise-grade access to high-performing foundation models from leading AI companies, enabling you to build and scale generative AI applications" (What is Amazon Bedrock); the FAQ adds that it is "serverless," so customers "don't have to manage any infrastructure" (Bedrock FAQs, 2026-08-20). It is a cloud model platform, not a third-party routing proxy.

Who pays the model bill

Not applicable

It is the model provider, so inference is billed by the platform itself rather than resold.

Bedrock is a first-party inference platform; there are no upstream provider keys to bring, and access is authenticated with AWS credentials (SigV4) or Amazon Bedrock API keys (Chat Completions API; Amazon Bedrock API keys).

Merchant of record: AWS: usage is billed on the AWS account ("You are charged…") per the Bedrock pricing page (Amazon Bedrock pricing), including per-use charges for Guardrails, while access through SageMaker Unified Studio "comes at no extra cost," with users paying for "the usage of the underlying resources" (Bedrock FAQs, 2026-08-20). An explicit statement naming the invoicing entity for third-party models: n.a. (the FAQ only labels some models "Third-Party Content").

Key handling: Authentication is AWS-native: Amazon Bedrock API keys authenticate with a bearer token "instead of AWS credentials", where short-term keys inherit permissions from the IAM principal that generated them and long-term keys create an IAM user with attached policies; SigV4 AWS credentials also work (Amazon Bedrock API keys; Chat Completions API). There are no upstream provider secrets to store. Requests are processed inside the customer's AWS account boundary and can be kept off the public internet with PrivateLink (Bedrock FAQs, 2026-08-20); batch inputs/outputs live in the customer's own S3 buckets (Batch inference).

Where it can run

2 of 5 shapes documented

Vendor-hosted
Self-host
Your VPC
On-premise
Air-gapped

Dimmed shapes are not documented by the vendor, which is not the same as unsupported.

hosted cloud service (fully managed, serverless) (Bedrock FAQs, 2026-08-20); customer-VPC private connectivity via AWS PrivateLink — "establish private connectivity between your FMs and your Amazon Virtual Private Cloud (Amazon VPC) without exposing your traffic to the Internet" (Bedrock FAQs); dedicated managed endpoints for Marketplace models, deployed "onto fully managed endpoints," including "a fully managed SageMaker endpoint" with a chosen instance count/type (Bedrock FAQs). Self-host, on-prem, air-gapped: n.a.

There is no customer-installed gateway: applications call regional bedrock-runtime (or bedrock-mantle) endpoints (Inference using Invoke API; Chat Completions API). Customer-owned weights arrive through Custom Model Import, which "only supports Llama 2/3, Mistral, and Flan architectures", and models fine-tuned in SageMaker can be brought back only if their architecture is import-supported (Bedrock FAQs, 2026-08-20; Custom model import overview). Feature gating is by region/eligibility rather than tier — e.g. Guardrails Standard tier "requires opting into cross-region inference," and some models are limited-availability (Bedrock FAQs; Custom model import overview).

API surfaces your code can keep using

3 of 7 documented

OpenAI chatPOST /v1/chat/completionsYes
https://bedrock-runtime.{region}.amazonaws.com/openai/v1/chat/completions and https://bedrock-mantle.{region}.api.aws/v1/chat/completions (Chat Completions API). Native alternatives are InvokeModel and the unified Converse API (Bedrock FAQs, 2026-08-20).
Anthropic messagesPOST /v1/messagesNot documented *
n.a. as a native Anthropic Messages endpoint; Anthropic models are reached through Bedrock's own InvokeModel/Converse APIs (Bedrock FAQs, 2026-08-20; Inference using Invoke API).
OpenAI ResponsesPOST /v1/responsesYes
OpenAI GPT-5.6 Sol, Terra and Luna are available "through the Responses API on Amazon Bedrock," and server-side Web Search is invoked through "a single tool-use parameter in the Responses API" (Custom model import overview / Bedrock what's-new content; What is Amazon Bedrock). Exact path: n.a.
EmbeddingsPOST /v1/embeddingsNot documented *
n.a. as a dedicated endpoint path; embeddings run as model invocations on the bedrock-runtime endpoint (InvokeModel) (Inference using Invoke API).
ImagesPOST /v1/images/generationsNot documented *
n.a. as a dedicated endpoint path; image/video generation providers (Stability AI, Luma AI, TwelveLabs) are invoked through the same runtime APIs, including StartAsyncInvoke for asynchronous generations (Bedrock FAQs, 2026-08-20; Inference using Invoke API).
AudioPOST /v1/audio/*Not documented *
n.a. on the pages fetched (no STT/TTS endpoint documented in Bedrock's inference API pages), though InvokeModelWithBidirectionalStream exists for streaming multimodal interaction (Inference using Invoke API).
Batch jobsPOST /v1/batchesYes
"With batch inference, you can submit multiple prompts and generate responses asynchronously," formatted with either InvokeModel or Converse request format, with input/output JSONL files in S3; it does not support tool calling or structured output (response_format), each record is processed independently without multi-turn, and "batch inference isn't supported for provisioned models" (Batch inference).

An asterisk marks a qualified verdict: support that is indirect (SDK compatibility or provider passthrough rather than a native endpoint), or a gap that is narrower or wider than the label suggests. Read the note before porting.

Bedrock's primary surface is proprietary (InvokeModel, InvokeModelWithResponseStream, StartAsyncInvoke, InvokeModelWithBidirectionalStream, Converse), reached through AWS SDKs — "iOS and Android SDKs, as well as Java, JS, Python, CLI, .Net, Ruby, PHP, Go, and C++", with "streaming supported on all the SDKs" (Inference using Invoke API; Bedrock FAQs, 2026-08-20). An OpenAI-compatible base-URL swap is possible for the chat-completions path using a Bedrock API key (Chat Completions API). The Converse API is "a unified API that abstracts FM differences and enables model switching with a single parameter change" (Bedrock FAQs).

How much it reaches

Models~100

Upstream providersNot published

"100+ foundation models" (What is Amazon Bedrock, undated); separately, Bedrock Marketplace offers "over 100 popular, emerging, or specialized models" (Bedrock FAQs, 2026-08-20). The former per-model catalog page has been consolidated into a "models at a glance" page (Supported foundation models, undated).

First-party platform with partner catalog, so no routed-provider count: AWS states "100+ foundation models from industry-leading providers" and names Amazon, Anthropic, DeepSeek, Moonshot AI, MiniMax, OpenAI, xAI (What is Amazon Bedrock, undated). The FAQ lists 13 providers — AI21 Labs, Amazon, Anthropic, Cohere, DeepSeek, Luma AI, Meta, Mistral AI, OpenAI, poolside "(coming soon)", Stability AI, TwelveLabs, Writer — without a total (Bedrock FAQs, 2026-08-20).

Whose models: Documented mix. Amazon Titan models are "created by AWS," "exclusive to Amazon Bedrock," and served through "a fully managed API"; third-party models are supplied by partner providers and some Bedrock models are sold by third-party providers as "Third-Party Content"; Bedrock Marketplace models are "offered by various providers" and deployed to fully managed SageMaker endpoints (Bedrock FAQs, 2026-08-20). Inference is supported "in all Regions and with all models supported by Amazon Bedrock" (Supported Regions and models for inference).

Your own endpoints: Partly: customers can bring their own weights via Custom Model Import (Llama 2/3, Mistral, Flan architectures) and deploy Marketplace models to their own managed SageMaker endpoints; Guardrails can also be applied to "self-hosted models outside Amazon Bedrock" (Bedrock FAQs, 2026-08-20; Custom model import overview). Registering an arbitrary external private URL as a Bedrock model: n.a.

How it behaves in production

What happens when an upstream model is slow, wrong, or down — and what you can see and stop while it happens. Reliability features are recorded as where you configure them, not whether the vendor lists them, because almost every product here lists all of them.

0 of 6 reachable from code4 of 4 can block3 documented destinations

When something goes wrong

Each row says where the knob is, not whether the feature is on the marketing page. A control you can only reach by hand in someone else’s dashboard cannot be reviewed or version-controlled.

Request timeoutNot documented
The vendor does not document this, so any behaviour you observe today is unversioned and may change.
No timeout header, URI parameter or body field. Timeout surfaces only as an error: ModelTimeoutException, HTTP 408, "Processing time exceeded the model timeout length" (Bedrock ConverseStream API).
RetriesNot documented
not_documented as a service-side setting. The API reference states that for ModelNotReadyException (HTTP 429) "The AWS SDK will automatically retry the operation up to 5 times"; no retry key or backoff strategy is published, so default backoff is n.a. (Bedrock ConverseStream API).
Fallback to another modelNot documented
not_documented for model/provider fallback. The only documented fallback-like behavior is latency-mode degradation: when the latency-optimization quota is reached "we will attempt to serve the request with Standard latency", and Llama 3.1 405B requests above ~11K total tokens "fall back to the standard mode" — controlled by performanceConfig.latency: standard | optimized, not by a fallback list (Bedrock latency-optimized inference).
Load balancingFixed, cannot change
The behaviour is fixed by the vendor. Predictable, but you cannot tune it for your workload.
An inference profile "distributes model invocation requests across these Regions", with no weights or policy keys exposed (Bedrock inference profiles).
Upstream health trackingNot documented
No health check, circuit breaker or ejection control; only error types (throttlingException, serviceUnavailableException, modelStreamErrorException) (Bedrock ConverseStream API).
Cross-region failoverFixed, cannot change
not_configurable in the sense asked: AWS runs the regions and picks for you. Cross-Region inference uses inference profiles that "define a foundation model (FM) and the AWS Regions to which requests can be routed"; for geographic or global profiles "Amazon Bedrock automatically selects a commercial AWS Region to process the request", and manual Region enablement is not required. You choose a profile, not a failover policy (Bedrock cross-Region inference, Bedrock inference profiles).

Cross-Region inference adds no routing cost, is billed at the source Region's price, stays on the AWS network, is encrypted in transit, and is auditable via CloudTrail additionalEventData.inferenceRegion (Bedrock cross-Region inference). Latency-optimized inference was in preview on the fetched page and is limited to specific models/regions (Bedrock latency-optimized inference).

How fast the hop is

Cloud provider API

Not a gateway you deploy: routing is a feature of the cloud API itself, so overhead is whatever the cloud adds and is not separately measurable.

A managed AWS regional service invoked through AWS SDKs; no runtime disclosed (Bedrock ConverseStream API).

You can run the request path yourselfNo

StreamingYes

no (Bedrock ConverseStream API).

Streaming caveats: Supported via InvokeModelWithResponseStream and ConverseStream. Caveats: check responseStreamingSupported from GetFoundationModel before assuming a model streams; "The AWS CLI doesn't support streaming operations in Amazon Bedrock, including ConverseStream"; mid-stream failures arrive as modelStreamErrorException (HTTP 424, "A streaming error occurred. Retry your request."); requires bedrock:InvokeModelWithResponseStream (Bedrock ConverseStream API).

This vendor publishes no latency or throughput figure for the routing layer. That is the most common case here, and it is why the architecture class above carries the comparison instead of a number.

No figures published, vendor or otherwise (Bedrock latency-optimized inference).

What it will stop

4 of 4 can block

Two separate questions per control: can it stop a request at all, and what does it do before you change any settings? A control that inspects and forwards is a logging feature, however it is named.

Personal data in promptsCan block the request
Out of the box: You pick the action when configuring
Sensitive information filters detect PII entity types and custom regex entities, with per-entity behaviour of BLOCK or MASK on both input and output (Sensitive information filters, Guardrail components)
Prompt injection and jailbreaksCan block the request
Out of the box: Blocks out of the box
"Prompt attack" is one of the content-filter categories with configurable strength thresholds; the detection mechanism is an AWS-managed classifier and is not described in detail (Guardrail components, IAM policy-based enforcement)
Harmful contentCan block the request
Out of the box: Blocks out of the box
Content filters cover hate, insults, sexual, violence, misconduct, and prompt attacks, with configurable thresholds applied to prompts and responses (Guardrail components)
Your own policiesCan block the request
Out of the box: You pick the action when configuring
Customer policy forms are denied topics (natural-language topic definitions), word filters including custom word/phrase lists (profanity, competitor names), custom regex entities, and Automated Reasoning checks for policy validation (Guardrail components, IAM policy-based enforcement)

Where checks runOn the vendor's servers

If the guardrail itself failsNot documented

Almost no vendor in this catalogue documents what happens when the guardrail service itself times out. If the control matters to you, this is a question worth asking before you sign.

No documented timeout/fail-open behaviour for the guardrail evaluation itself (Guardrail components)

Two features stand out for auditors: ApplyGuardrail lets the same policy be enforced for models running outside Bedrock, and IAM condition-based enforcement can make an un-guardrailed InvokeModel call impossible rather than merely discouraged (IAM policy-based enforcement).

What you can see

Exports to a few places

What gets loggedNothing stored

No request logging is offered, so debugging depends on your own instrumentation.

You can turn bodies offYes

Leaving model invocation logging off keeps CloudWatch operational metrics without any prompt/completion storage; the feature is opt-in per account/region (Model invocation logging)

TracesOpenTelemetry

n.a. from the fetched pages — guardrail traces are logged as part of invocation logs, but OpenTelemetry support is not documented on the pages fetched (Model invocation logging)

Model invocation logging is disabled until the customer enables it; once enabled it captures full input and output JSON (payloads above 100 KB are stored in S3) to CloudWatch Logs and/or S3, and can include guardrail trace detail (Model invocation logging, IAM policy-based enforcement)

Where telemetry can go

CloudWatch Logs
S3
CloudTrail

Amazon CloudWatch Logs and Amazon S3 for invocation logs (Model invocation logging); AWS CloudTrail records guardrail configuration and enforcement actions (IAM policy-based enforcement)

Records user feedbackNo

Scores live trafficNo

n.a. (Model invocation logging)

n.a. on the fetched pages; the closest documented mechanism is ApplyGuardrail, which evaluates text without invoking a model and can therefore be run over stored traffic (IAM policy-based enforcement)

Retention: Determined by the destination the customer chooses (CloudWatch Logs group retention or S3 lifecycle policy); no Bedrock-side default window is stated (Model invocation logging)

Whether it fits how you work

How much work stands between you and a first call, how different that is from running it in production, and whether it slots into the stack you already have. Recorded as the shape of the work rather than a number of minutes — how long it takes you depends on which accounts and quota you already hold, which no comparison can know.

to try: cloud console setupto run: cloud console setupfits 4 of 10 common stacks

Getting to a first call

5 numbered steps

Shape of the workSet it up in a cloud console

You cannot start from an empty editor. An account, a project or a deployed resource has to exist first, and that step is done by hand.

Read off: the vendor’s own quickstart — 5 numbered steps.

Before step one

Your own provider keyNot needed
You can make a first call with only this product’s key. No upstream provider account needed.
. Authentication uses a Bedrock short-term API key generated in the console (Quickstart - Amazon Bedrock)
Payment methodCard needed before models work
Not stated in the quickstart; the pricing page says "Get started for free." However model access requires "Valid AWS Marketplace payment method." (Amazon Bedrock Pricing, Request access to models - Amazon Bedrock)
Gate before models answerApproval required
A form, subscription or approval sits between you and the model. Plan for a wait you do not control.
Yes, partly automated: "Access to all Amazon Bedrock foundation models is enabled by default with the correct AWS Marketplace permissions" and "When you invoke a third-party model for the first time in your account, Amazon Bedrock automatically initiates the subscription process in the background"; Anthropic models require a First Time Use (FTU) form (companyName, companyWebsite, intendedUsers, industryOption, useCases) after which "Access to the model is granted immediately after use case details are successfully submitted"; subscription setup "may take up to 15 minutes." GovCloud console access is a 10-step procedure ending "the Access status changes to Access granted or Available to request," and a 5-step programmatic procedure exists (Request access to models - Amazon Bedrock). Non-GA models are gated: "Access to Claude Mythos 5 and Claude Mythos Preview is gated and requires approval. Contact your Anthropic account team to request access on Bedrock." (Amazon Bedrock Pricing)

Everything you need first: An AWS account (step 1) and Python already installed; an SDK for the chosen API; environment variables for the API key. Marketplace-related IAM permissions matter for model access (Quickstart - Amazon Bedrock, Request access to models - Amazon Bedrock)

Copyable snippet: incomplete. Partially: the page instructs you to save Python code as bedrock-first-request.py and run python3 bedrock-first-request.py, and recommends the bedrock-runtime endpoint, but no request snippet was rendered in the fetched content (Quickstart - Amazon Bedrock)

The vendor’s own time claim: Vendor claim (page description), verbatim: "Get started with Amazon Bedrock in minutes." (Quickstart - Amazon Bedrock) Quoted, not verified. Marketing time claims assume every account and approval is already in place.

Running it in production

The same scale applied to the path the vendor recommends for production traffic. Kept separate from the quickstart because for several products here the two are barely related pieces of work.

Shape of the workSet it up in a cloud console

You cannot start from an empty editor. An account, a project or a deployed resource has to exist first, and that step is done by hand.

What production needs: IAM roles / temporary credentials instead of the short-term API key; for managing model access via SDK/CLI: attach AmazonBedrockFullAccess, configure the AWS SDK, AWS CLI version 2.27.42 or later, and know the model ID; Marketplace permissions aws-marketplace:Subscribe, Unsubscribe, ViewSubscriptions; a valid AWS Marketplace payment method; GovCloud third-party models require access enabled in both the linked commercial account and the GovCloud account (Quickstart - Amazon Bedrock, Request access to models - Amazon Bedrock)

Can you run it yourself

Install command publishedNo self-hosting

This runs on the vendor’s infrastructure only.

How it fits your stack

4 of 10

Each row is a thing you might already run. “With a caveat” means it works but not the way the vendor’s marketing implies — read the reason, because that is usually where the surprise lives.

FitsThe OpenAI SDKDrop-in once set up — but first-call work is cloud console setup.
FitsThe Vercel AI SDK@ai-sdk/amazon-bedrock
With a caveatCloudflare WorkersDocumented by Cloudflare, not the vendor.
NoKubernetesOnly generic cluster docs — nothing to install for this product.
With a caveatTerraform or OpenTofuResources in the cloud’s provider
With a caveatAn existing API gatewayThe cloud ships its own AI gateway
FitsCloud IAM I already runReuses IAM roles, workload identity or managed identities.
FitsLangChain or LlamaIndexLlamaIndex, Strands
With a caveatMCP servers to governMCP tools in the API — governs nothing on your side.
NoNothing — plain Node or PythonA cloud console or resource has to exist before your first call.

Reading this the other way round — pick what you already run and see every product scored against it.

The integration surfaces behind those answers

Vercel AI SDKOfficial provider package
Install the package, swap the model factory, done. Maintained by a party with a stake in it.
Named: @ai-sdk/amazon-bedrock
Per an AWS Vercel case study, Vercel AI SDK integrates with Amazon Bedrock through the dedicated provider package @ai-sdk/amazon-bedrock. (AWS Vercel case study)
Cloudflare WorkersDocumented by Cloudflare, not the vendor
The integration is documented by Cloudflare rather than by this vendor, so treat it as a working recipe without a vendor support commitment.
Documented by:Cloudflare
Documented by Cloudflare: Bedrock can be called from a Cloudflare Worker through Cloudflare AI Gateway using the aws4fetch library for client-side AWS SigV4 signing. (Cloudflare AI Gateway - Amazon Bedrock provider)
KubernetesOnly generic cluster docs
The Kubernetes docs are about running workloads on the platform generally, not about deploying this product. There is nothing here to install.
Named: EKS Helm documentation only; no Bedrock chart or operator
Amazon EKS documentation describes Helm for installing and managing charts, including charts from the eks-charts GitHub repository or ArtifactHub. No official Amazon Bedrock gateway Helm chart or operator is documented. (Helm on Amazon EKS)
TerraformResources in the cloud’s provider
Managed through the hyperscaler’s own provider rather than a dedicated one. Coverage follows the cloud’s resource model, not the product’s features.
Named: hashicorp/aws resource aws_bedrockagentcore_registry — deprecated, moving to agent-registry on 2026-08-06 and working until 2026-09-17
The HashiCorp AWS provider documents the Terraform resource aws_bedrockagentcore_registry. The resource is deprecated; the evidence states that functionality will move from the bedrock-agentcore namespace to agent-registry on August 6, 2026, while the resource continues to work until September 17, 2026. (Terraform AWS AgentCore Registry resource)
Existing API gatewayThe cloud ships its own AI gateway
The cloud provides its own AI gateway for this surface, so the governance layer is a platform choice rather than a third-party product.
Amazon Bedrock AgentCore Gateway is the documented gateway platform. The evidence does not document Kong, APISIX, Envoy, Istio, or nginx gateway plugins for Amazon Bedrock. (AgentCore Gateway MCP server)
Cloud identityReuses your cloud identity
Authenticate with the identity you already run — IAM roles, workload identity or managed identities. No long-lived key to rotate.
Amazon Bedrock supports AWS credentials for HTTP requests, while OpenAI SDK usage requires an Amazon Bedrock API key. For AgentCore Gateway, IAM SigV4 is the default inbound authorization mechanism and IAM-based authentication is supported. (Amazon Bedrock authentication and endpoints)
MCPMCP tools in the API
The completion API accepts MCP tool definitions, so the model can call MCP tools. A model capability, not an MCP control plane.
Amazon Bedrock AgentCore supports MCP Streamable HTTP transport, normally with stateless_http=True; the /mcp endpoint supports MCP RPC messages, tool invocation and management, capability discovery, resource access, and multi-step workflows. Stateful sessions use the Mcp-Session-Id header, and the required container port is 8000. (AgentCore Runtime MCP protocol contract)

Python frameworks

LlamaIndex
Strands

LlamaIndex integrations are documented for Amazon Bedrock, including Bedrock, BedrockEmbedding, AmazonKnowledgeBasesRetriever, RouterQueryEngine, SubQuestionQueryEngine, and ReActAgent. AWS Strands is also explicitly documented as a supported agent framework for AgentCore Runtime. (LlamaIndex and Amazon Bedrock RAG)

First-party client libraries

C++
Go
Java
JavaScript
Kotlin
.NET
PHP
PowerShell
Python
Ruby
Rust
SAP ABAP
Swift

The OpenAI Python SDK is documented with from openai import OpenAI; the examples require Python 3.7 or later and use pip install openai boto3. AWS SDKs are available for C++, Go, Java, JavaScript, Kotlin, .NET, PHP, PowerShell, Python/Boto3, Ruby, Rust, SAP ABAP, and Swift; the JavaScript v3 Bedrock Runtime package is @aws-sdk/client-bedrock-runtime, with classes including BedrockRuntimeClient, ConverseCommand, ConverseStreamCommand, and InvokeModelCommand. (Amazon Bedrock SDK general information)

Agent features: Amazon Bedrock Mantle supports stateful conversation management, previous_response_id, streaming, multi-turn interactions, client-side tool use, background processing, and asynchronous inference on bedrock-mantle; server-side tools are unavailable on bedrock-runtime. AgentCore additionally documents stateful MCP sessions, elicitation, sampling, progress notifications, managed memory and session state, and multi-step agent workflows. (Amazon Bedrock Mantle agent capabilities)

Multiple API surfaces are available (Anthropic-native Messages, OpenAI-compatible Responses, Chat Completions, Converse, Invoke), so SDK choice depends on the API. After permissions are granted, completion "may take up to 2 minutes." Availability responses expose agreementAvailability: AVAILABLE, authorizationStatus: AUTHORIZED, entitlementAvailability: AVAILABLE, regionAvailability: AVAILABLE (Quickstart - Amazon Bedrock, Request access to models - Amazon Bedrock)

Amazon Bedrock provides managed, serverless foundation models through unified bedrock-runtime and bedrock-mantle endpoints; bedrock-runtime is recommended for new applications, while Projects are created only on bedrock-mantle. The OpenAI-compatible endpoints are powered by Mantle, have endpoint-specific quotas, and are available in the documented AWS Regions; Amazon Bedrock Knowledge Bases can use Amazon S3 and Amazon OpenSearch Serverless. (Amazon Bedrock Mantle overview)

What it does well

19 model providers plus custom model import under one AWS API and one bill
Deep compliance posture: ISO, SOC, CSA STAR Level 2, GDPR, FedRAMP High, HIPAA-eligible with an AWS BAA
Built-in Guardrails, evaluations, Knowledge Bases and AgentCore instead of bolt-on tooling
Cost levers: Batch and Flex at 50% off Standard, prompt caching, Intelligent Prompt Routing, Provisioned Throughput commitments
OpenAI-compatible Responses and Chat Completions endpoints ease migration

Where it falls short

Not a cross-cloud gateway: it only routes to models AWS hosts, so no failover to OpenAI, Azure or Google endpoints
Deep AWS lock-in — IAM, regions and fine-tuned artifacts do not port to Vertex AI or Foundry
Pricing is fragmented across tiers, Provisioned Throughput units and per-feature surcharges, making forecasts hard
Model availability varies by Region, so a model you tested may be unavailable where your data must live

Choose it when

Teams already standardized on AWS that need many model vendors behind one IAM-governed, compliance-attested API.

Look elsewhere when

You want vendor-neutral routing across multiple clouds or a single flat per-token price list.

Cloud platform: A hyperscaler surface offering several vendors models under one contract, one bill, and one identity system. Strong compliance story, limited to that cloud.

How hard is it to leave?

Derived from six published facts, not from an opinion. The weights are fixed and the same for every product — see the arithmetic.

60/80Some work to leave

Portability score breakdown for Amazon Bedrock
What helps you leave	Points	Source
Works with standard OpenAI codeSwitching away is a base-URL change rather than a rewrite of every call site.	22/22	vendor page
No vendor-specific SDK requiredA proprietary client library spreads through your codebase and has to be torn out again.	10/10	vendor page
Can use your own provider accountsYour keys and billing relationship stay yours, so removing the gateway does not cut off model access.	not published	—
Can be self-hostedYou can run it yourself instead of accepting a pricing or policy change.	0/20	—
Configuration lives in version controlRouting and budget rules are a file you keep, not dashboard state you would have to rebuild.	16/16	vendor page
Your request history can be exportedYou leave with your own logs instead of abandoning them.	12/12	vendor page

Read the fine print: boto3 remains the primary SDK, but the newer endpoint accepts the OpenAI client.

1 of the 6 inputs is not published, so the highest reachable score here is 80 rather than 100. That is a gap in the public documentation, not a mark against the product — no points are deducted, they simply cannot be claimed. This measures technical switching cost only. It does not price the engineering time to re-test prompts against a different routing stack.

Full specification

Every field we track. Blank fields say "Not published" rather than "No" — we do not infer an absence from silence. Switch to Technical in the header for the precise field names and the low-level details.

Overview

What kind of product Category: Cloud platform Not verified; Marketplaces resell many providers behind one key. Gateways add governance on top. Open-source projects you run yourself. Cloud platforms are hyperscaler surfaces. Inference providers host models on their own hardware.
Who runs it Deployment model: Managed only Not verified; Managed means the vendor operates it. Self-host means you run it on your own infrastructure. Both means you can choose.
Licence Licence: Proprietary Not verified; Proprietary products cannot be inspected or forked. Open licences such as MIT and Apache-2.0 let you audit, modify, and run the code without permission.
Company Company: Amazon Web Services Verified 2 days ago; The organisation that maintains the product.
Who you would be signing with Vendor status: Large cloud vendor product Not verified; Whether the product is still an independent company, has been acquired, is a large cloud vendor’s product line, is run by a software foundation, or has been put into maintenance mode. Maintenance mode means bug fixes and security patches only — no new features.
Last shipped an update Latest release: 2026-08-24 Not verified
AWS publishes no versioned Bedrock changelog, so this is the most recent entry in the user guide's document history — a documentation update, not a product release.; The date of the most recent release or version tag. A product that has not shipped in a year is a different risk from one that shipped last week, regardless of what its marketing site says.
GitHub stars GitHub stars: Not published Not verified; A rough proxy for community size on open-source projects. Not a quality measure.

Cost

Markup on model prices Token markup: Not published Not verified; How much the product adds on top of what the underlying model provider charges. Zero means you pay the same per-token price you would pay the model provider directly.
Fee to add funds Credit purchase fee: Not published Not verified; A percentage charged when you top up your balance, separate from token prices. It is easy to miss because it does not appear on the per-token price list.
Monthly cost per person Seat fee: Not published Not verified; A recurring per-user platform charge that applies regardless of how much you use the models.
Can use your own provider accounts BYOK supported: Not published Not verified; Bring Your Own Key: you keep direct contracts with OpenAI, Anthropic and others, and the gateway only routes traffic. This preserves negotiated rates and committed-spend discounts.
Cost of using your own accounts BYOK terms: Not published Not verified; What the product charges to route traffic through your own provider keys.
Free tier Free tier: No Bedrock-specific free tier; new AWS customers get up to $200 in AWS credits ($100 immediately plus up to $100 earned, over 6 months). Verified 2 days ago; What you can do without paying, useful for evaluation.
Enterprise plan from Enterprise plan from: Not published Not verified; Annual entry price for the enterprise tier, where one is published or credibly reported.
Cost to run it yourself Self-host cost: Managed only, no self-host option. Bedrock sets its own per-token prices rather than marking up a third party: Standard, Flex and Batch (both 50% below Standard) and Priority (75% above Standard) tiers, plus Provisioned Throughput billed per model unit-hour with no-commitment, 1-month or 6-month terms. Verified 2 days ago; What self-hosting actually costs once you account for infrastructure and any paid tier.
How the vendor makes money Pricing model: Bundled — inference is the product Not verified; The shape of the vendor’s bill: does the routing layer charge a percentage on top of tokens, a flat monthly fee, both, neither (because inference is the product), or nothing at all (open source with no paid tier).
How pricing works, briefly Pricing model detail: Pay-for-own-inference, bundled routing: gateway/API layer carries no separately stated fee. Per-token (on-demand), per batch token, or per provisioned model unit hour. Service tiers: Priority +75% to Standard; Flex −50%; Batch −50%. Not verified; A one-paragraph description that covers the caveats a pricing category cannot: introductory rates, per-feature meters, tier gating, and pricing that resets on a specific date.
Minimum commitment Minimum commitment: None for on-demand. Provisioned Throughput uses 1-month and 6-month commitments (e.g. Cohere Command $39.60/hr/model unit for 1 mo vs $23.77 for 6 mo; Llama 2 70B $21.18 vs $13.08); pricing requires contacting your account team. Not verified; Whether the vendor requires a minimum contract term, a minimum spend, or a provisioned-capacity purchase to get its published rate.
Charges that fire after you go over an allowance Overage terms: No log/trace retention overage, request-volume overage or data-export charge. Adjacent charges are usage-metered: model customization, storage, retrieval, guardrails, evaluations, Advanced Prompt Optimizer (charged for on-demand Standard-tier tokens used in optimization). Not verified; The line items that scale with usage after an included allowance is exhausted — log storage, extra requests, per-feature meters, data export — which is where cost estimates usually go wrong.
Prompt cache offered Cache mechanism: Both exact and semantic Not verified; Whether the gateway offers its own response cache, what kind of match it does (exact request, prefix, semantic), or simply passes provider caching through unchanged.
Discount on cached input Cache-read discount: 90% Not verified; How much cheaper cached tokens are than fresh input, when the vendor publishes a single figure. Bundled-inference clouds usually price this per model instead of as one number.
Premium on cache writes Cache-write premium: 25% Not verified; How much more the first write of a cached prefix costs versus a plain input token. A high write premium and a low hit rate can leave you paying more than you save, so this matters as much as the read discount.
Who captures the cache saving Cache economics: Implicit and explicit prompt caching (prefix-based, not semantic). Explicit uses cache checkpoints (up to 4 per request); TTLs commonly 5 min (Anthropic 1h option, GPT-5.6 default 30m). Implicit caching is best-effort — identical prompts don't guarantee a hit. Cache reads billed at 90% discount for GPT-5.6 (Claude 3.5 Sonnet v2 cache read $0.60 vs $6.00 input = 90% off on the pricing page). Cache writes billed at 1.25× uncached input rate (+25%). Cache saves money conditionally: writes cost 25% more up front and hits are never guaranteed, so a low-hit-rate workload can pay more than it saves. AWS captures nothing extra beyond the write premium. Not verified; Whether the customer keeps the full saving from caching or the vendor captures part of it — and any conditions attached (write premium, storage fees, best-effort hits).
What you can split spend by Cost attribution: Not stated on the pricing page. Cost shaping levers Bedrock does publish: service tier (Flex/Priority), batch, Provisioned Throughput commitments. Not verified; The dimensions the vendor documents for splitting spend — per key, per user, per team, per tag, per customer. Matters if you need to chargeback internally or bill an end customer.
How you get cost data out Cost export: Not stated on the pricing page. Not verified; The mechanisms the vendor publishes for exporting cost and usage data: CSV, an API, webhooks, S3, a data warehouse, or nothing at all. Any per-unit price is included.
Who pays the model bill BYOK mode: Not applicable Not verified; Whether you bring your own provider accounts (BYOK), buy inference from this vendor, or can do either. This is the single biggest commercial difference between these products: it decides who holds the contract with the model provider and who carries the spend.

Spend governance in detail

Seven signals matter when a bill starts to hurt: who can spend, how much, on what, and who gets paged when it goes wrong. Everything below is drawn from the vendor’s own pricing and docs pages — how we read these.

Virtual or scoped keysNot published
Keys that carry their own budget and rate-limit policy, so an intern experiment cannot spend against a production budget.
Not stated on the pricing page.
Budget caps per keyNot published
A dollar or token ceiling attached to an individual key. Where enforcement is soft, one over-limit request still completes before the block kicks in.
Not stated on the pricing page.
Budget caps per team or workspaceNot published
A ceiling applied at a higher scope than one key — a team, a workspace, a customer, or an entire environment.
Not stated on the pricing page.
Rate limiting as a cost controlNot published
Configurable request-per-time-window caps. Platform-set rate limits do not count as spend controls; user-configurable ones do.
Not stated as a cost control on the pricing page.
Model allowlistsNot published
A policy that constrains which models a key or team can call, keeping expensive frontier models out of the wrong hands.
Not stated on the pricing page.
Spend alertsNot published
Alerts fired as spend approaches a threshold. Alerts that only fire after the meter has rolled over are marked as such.
Not stated on the pricing page.
Webhook notificationsNot published
Programmatic notifications on spend events, so budget breaches can page an on-call or open a ticket.
Not stated on the pricing page.

Enforcement:Enforcement point not stated

Catalog

Models available Models available: ~100 Verified 2 days ago; How many models you can call, shown as a range because several vendors publish different totals on different pages. Vendor-reported either way, so counts are not directly comparable — some count every provider variant of the same model separately.
Model providers reachable Upstream providers: Not published Verified 2 days ago; How many distinct model providers or labs you can reach, shown as a range where the vendor’s own pages disagree. More providers usually means better redundancy when one has an outage.
Works with standard OpenAI code OpenAI-compatible API: Yes Verified 2 days ago; If yes, you can usually switch to it by changing one base URL, and switch away just as easily. This is the main defence against lock-in.
OpenAI chat endpoint POST /v1/chat/completions: Yes Not verified; The endpoint almost every application ports first. "Not documented" means the vendor never states it, which is different from a documented no.
Anthropic messages endpoint POST /v1/messages: Not documented Not verified; Whether Anthropic-shaped calls work without rewriting them. Several products support this only as SDK compatibility or provider passthrough rather than a native endpoint — the detail page says which.
OpenAI Responses endpoint POST /v1/responses: Yes Not verified; The newer stateful OpenAI surface. Support is much thinner across this market than chat completions.
Embeddings endpoint POST /v1/embeddings: Not documented Not verified; Whether you can generate vectors through the same gateway, or need a second integration for retrieval workloads.
Image generation endpoint POST /v1/images/generations: Not documented Not verified; Whether image models are reachable through the same surface as text.
Audio endpoints POST /v1/audio/*: Not documented Not verified; Speech-to-text and text-to-speech. Frequently the first gap in an otherwise complete gateway.
Batch jobs endpoint POST /v1/batches: Yes Not verified; Asynchronous bulk processing, usually at a discount. Commonly undocumented, and commonly the reason a migration stalls late.
Needs the vendor’s own code library Requires a vendor-specific SDK: No Verified 2 days ago; A proprietary client library spreads through your codebase and has to be torn out again if you leave. “No” is the better answer here, and it means the standard OpenAI client works.
You can export your request history Logs / usage data export: Yes Verified 2 days ago; Whether you can get your own request logs, traces, or usage records back out — through an API, a bulk export, or a download. Decides whether you leave with your history or abandon it.
Settings can live in version control Declarative config-as-code: Yes Verified 2 days ago; Whether routing, fallback, and budget rules can be declared in a file you keep in Git, rather than existing only as settings clicked into a hosted dashboard.
Embeddings Embeddings: Not published Not verified; Text-to-vector models, needed for search and retrieval features.
Image generation Image generation: Yes Verified 2 days ago; Whether image models are reachable through the same interface.
Speech and audio Speech and audio: Not published Not verified; Text-to-speech or transcription models through the same interface.
Video generation Video generation: Yes Verified 2 days ago; Whether video models are reachable through the same interface.
Batch processing Batch processing: Yes Verified 2 days ago; Submitting large jobs for cheaper, slower processing. Often 50% off for work that is not time-sensitive.

Routing & reliability

Uptime it promises in writing Contractual SLA uptime: 99.9% Not verified; The uptime percentage in a published, contractual service level agreement. A public status page is not an SLA — it reports what happened, it does not promise anything or pay you back when it breaks.
Automatic failover Automatic failover: Not published Not verified; When a model provider goes down or rate-limits you, traffic moves to a backup automatically instead of returning errors to your users.
Load balancing Load balancing: Yes Verified 2 days ago; Spreads requests across several providers or keys to raise your effective rate limit.
Rule-based routing Conditional routing: Yes Verified 2 days ago; Send different requests to different models based on rules — for example a cheap model for free users and a strong model for paying ones.
Response caching Response caching: Yes Verified 2 days ago; Reuses the answer when the exact same request comes in again, which cuts both cost and latency.
Similar-question caching Semantic cache: Not published Not verified; Reuses an answer when a new question means roughly the same thing as an earlier one. Saves far more than exact-match caching but can return subtly wrong answers if tuned loosely.
Where you set the timeout Request timeout surface: Not documented Not verified
No timeout header, URI parameter or body field. Timeout surfaces only as an error: `ModelTimeoutException`, HTTP `408`, "Processing time exceeded the model timeout length" ([Bedrock ConverseStream API](https://docs.aws.amazon.com/bedrock/latest/APIReference/API_runtime_ConverseStream.html)).; Where a request timeout can be set: per request, in a config file, in the vendor dashboard, or nowhere. Nine of the twenty products documented here do not describe a request timeout at all, so the worst case of a hung upstream call is unknowable from the docs.
Where you set retries Retry policy surface: Not documented Not verified
`not_documented` as a service-side setting. The API reference states that for `ModelNotReadyException` (HTTP `429`) "The AWS SDK will automatically retry the operation up to 5 times"; no retry key or backoff strategy is published, so default backoff is `n.a.` ([Bedrock ConverseStream API](https://docs.aws.amazon.com/bedrock/latest/APIReference/API_runtime_ConverseStream.html)).; Where retry count and backoff are configured. Worth knowing alongside billing: a retried streaming call can be charged more than once.
Where you set fallbacks Fallback surface: Not documented Not verified
`not_documented` for model/provider fallback. The only documented fallback-like behavior is latency-mode degradation: when the latency-optimization quota is reached "we will attempt to serve the request with Standard latency", and Llama 3.1 405B requests above ~11K total tokens "fall back to the standard mode" — controlled by `performanceConfig.latency: standard | optimized`, not by a fallback list ([Bedrock latency-optimized inference](https://docs.aws.amazon.com/bedrock/latest/userguide/latency-optimized-inference.html)).; Where the fallback chain is defined. Almost every product claims fallback; the useful question is whether you can change it from code or only by hand in a dashboard.
Shape of the fallback chain Fallback shape: Shape not documented Not verified; An ordered list tries targets in sequence; a weighted split sends a percentage of traffic to each, which is what you need to trial a new model on 5% of requests. Weighted splits are much rarer than the marketing implies.
Upstream health tracking Health checks / circuit breaking: Not documented Not verified
No health check, circuit breaker or ejection control; only error types (`throttlingException`, `serviceUnavailableException`, `modelStreamErrorException`) ([Bedrock ConverseStream API](https://docs.aws.amazon.com/bedrock/latest/APIReference/API_runtime_ConverseStream.html)).; Whether the product notices a failing upstream and stops sending traffic to it, and whether you can tune the thresholds. This is what turns a provider outage into a blip rather than a sustained error rate, and only four of the twenty expose it.
Cross-region failover you control Multi-region failover surface: Fixed, cannot change Not verified
`not_configurable` in the sense asked: AWS runs the regions and picks for you. Cross-Region inference uses inference profiles that "define a foundation model (FM) and the AWS Regions to which requests can be routed"; for geographic or global profiles "Amazon Bedrock automatically selects a commercial AWS Region to process the request", and manual Region enablement is not required. You choose a profile, not a failover policy ([Bedrock cross-Region inference](https://docs.aws.amazon.com/bedrock/latest/userguide/cross-region-inference.html), [Bedrock inference profiles](https://docs.aws.amazon.com/bedrock/latest/userguide/inference-profiles.html)).; Whether you can define what happens when a region degrades. A vendor running many regions is not the same as a vendor letting you configure failover between them; only three document a user-controlled mechanism.
Where you set load balancing Load balancing surface: Fixed, cannot change Not verified
An inference profile "distributes model invocation requests across these Regions", with no weights or policy keys exposed ([Bedrock inference profiles](https://docs.aws.amazon.com/bedrock/latest/userguide/inference-profiles.html)).; Where traffic distribution across upstreams or keys is configured.

Operations

Usage dashboards and logs Observability: Not published Not verified; Built-in visibility into what was sent, what came back, what it cost, and how long it took.
Spending limits Budget controls: Not published Not verified; Hard caps that stop spend before it becomes a surprise invoice. The single most valuable control for a small team.
Rate limits Rate limits: Not published Not verified; Caps on request volume per key or per user, useful for protecting against abuse and runaway loops.
Separate keys per team or app Virtual keys: Not published Not verified; Issue scoped keys with their own budgets and permissions so you can attribute cost and revoke access without rotating everything.
Prompt versioning Prompt management: Not published Not verified; Store and version prompts outside your code so they can be changed without a deploy.
Quality testing Evals: Yes Verified 2 days ago; Built-in tooling to score model output against test cases, so you can tell whether a model swap made things better or worse.
MCP support MCP support: Not published Not verified; Native support for the Model Context Protocol, the emerging standard for connecting models to external tools.
What gets logged Logged content: Nothing stored Not verified
Model invocation logging is disabled until the customer enables it; once enabled it captures full input and output JSON (payloads above 100 KB are stored in S3) to CloudWatch Logs and/or S3, and can include guardrail trace detail ([Model invocation logging](https://docs.aws.amazon.com/bedrock/latest/userguide/model-invocation-logging.html), [IAM policy-based enforcement](https://aws.amazon.com/blogs/machine-learning/amazon-bedrock-guardrails-announces-iam-policy-based-enforcement-to-deliver-safe-ai-interactions/)); Whether full prompts and responses are stored, only metadata, or nothing. Full-body logging is the most useful debugging feature here and the one most likely to need a conversation with your compliance team.
You can turn logging off Body-logging opt-out: Yes Not verified
Leaving model invocation logging off keeps CloudWatch operational metrics without any prompt/completion storage; the feature is opt-in per account/region ([Model invocation logging](https://docs.aws.amazon.com/bedrock/latest/userguide/model-invocation-logging.html)); Whether prompt and response bodies can be suppressed while still keeping usage metrics. Nineteen of the twenty document a way to do this; the mechanisms range from a per-request header to an organisation-wide setting.
Traces you can take elsewhere Distributed tracing: OpenTelemetry Not verified
`n.a.` from the fetched pages — guardrail traces are logged as part of invocation logs, but OpenTelemetry support is not documented on the pages fetched ([Model invocation logging](https://docs.aws.amazon.com/bedrock/latest/userguide/model-invocation-logging.html)); Whether the product emits OpenTelemetry, a proprietary format, or nothing. OpenTelemetry means the traces land in the tooling you already run instead of only in the vendor’s dashboard.
Where telemetry can go Export destinations: CloudWatch Logs, S3, CloudTrail Not verified
Amazon CloudWatch Logs and Amazon S3 for invocation logs ([Model invocation logging](https://docs.aws.amazon.com/bedrock/latest/userguide/model-invocation-logging.html)); AWS CloudTrail records guardrail configuration and enforcement actions ([IAM policy-based enforcement](https://aws.amazon.com/blogs/machine-learning/amazon-bedrock-guardrails-announces-iam-policy-based-enforcement-to-deliver-safe-ai-interactions/)); Documented sinks for logs and metrics. This is a good proxy for how replaceable the vendor’s own dashboard is: around twenty destinations means you never have to depend on it, while a CSV download means you do.
Can record user feedback Feedback capture API: No Not verified
`n.a.` ([Model invocation logging](https://docs.aws.amazon.com/bedrock/latest/userguide/model-invocation-logging.html)); Whether there is an API to attach a rating or score to a logged request, which is what lets production traffic feed quality work later.
Scores live traffic Online eval hooks: No Not verified
`n.a.` on the fetched pages; the closest documented mechanism is `ApplyGuardrail`, which evaluates text without invoking a model and can therefore be run over stored traffic ([IAM policy-based enforcement](https://aws.amazon.com/blogs/machine-learning/amazon-bedrock-guardrails-announces-iam-policy-based-enforcement-to-deliver-safe-ai-interactions/)); Whether automated scorers can run against real production requests, rather than only against a test set you assemble yourself.

Performance

Delay it adds Proxy overhead: Not published Not verified; Extra time the product itself adds to each request, on top of however long the model takes. Usually irrelevant next to multi-second model latency, but it matters for high-volume or streaming-sensitive workloads.
Requests per second ceiling Throughput: Not published Not verified; Published sustained request rate before the product becomes the bottleneck. Only relevant at genuinely high volume.
What the request path runs on Architecture class: Cloud provider API Not verified
A managed AWS regional service invoked through AWS SDKs; no runtime disclosed ([Bedrock ConverseStream API](https://docs.aws.amazon.com/bedrock/latest/APIReference/API_runtime_ConverseStream.html)).; The comparable way to talk about latency here. An edge worker, a compiled Go or Rust binary, and a Python proxy have different overhead floors no matter which figures each vendor publishes. Products that never disclose their runtime are recorded as undisclosed rather than assumed.
You can run the request path yourself Self-hostable data plane: No Not verified
`no` ([Bedrock ConverseStream API](https://docs.aws.amazon.com/bedrock/latest/APIReference/API_runtime_ConverseStream.html)).; Whether the component that actually carries your prompts can run on your own infrastructure. Distinct from a vendor offering a self-hosted control plane while still proxying traffic through their network.
Streaming responses Streaming support: Yes Not verified
Supported via `InvokeModelWithResponseStream` and `ConverseStream`. Caveats: check `responseStreamingSupported` from `GetFoundationModel` before assuming a model streams; "The AWS CLI doesn't support streaming operations in Amazon Bedrock, including `ConverseStream`"; mid-stream failures arrive as `modelStreamErrorException` (HTTP `424`, "A streaming error occurred. Retry your request."); requires `bedrock:InvokeModelWithResponseStream` ([Bedrock ConverseStream API](https://docs.aws.amazon.com/bedrock/latest/APIReference/API_runtime_ConverseStream.html)).; Whether token-by-token streaming is documented. The caveats matter more than the yes: some products cannot cancel a stream without still being billed, and several timeout and fallback mechanisms stop applying once the first token has been sent.

Security & compliance

Does your prompt reach their servers Prompt transits vendor: Yes Not verified
Serverless inside AWS, and you can keep it off the public internet with PrivateLink. Model providers are walled off: they have no access to Bedrock logs or to your prompts and completions.; Whether the text you send passes through this company’s own infrastructure. If it does, every other promise on this page is a policy commitment rather than a physical impossibility. Self-hosted products can answer no outright.
What they keep if you change nothing Logging default: Nothing stored by default Not verified
Model invocation logging is disabled by default, and when you enable it the logs go to your own S3 or CloudWatch in the same account and region. Bedrock's stated baseline is a zero-data-retention model.; Defaults matter more than options. A product that stores full prompts and replies unless you find the right header will have stored them by the time you read the docs.
How long they keep it Default content retention (days): Nothing kept by default Not verified
Nothing stored by default. Named exceptions run to 30 days for certain third-party models, including classifier-flagged traffic on some OpenAI models and inputs and outputs on some Anthropic models.; Default retention for request content, in days. Zero means nothing is kept. Read the note: several products keep nothing as a rule but make timed exceptions for abuse review or specific models.
Could they train on your prompts Training on customer data: No Not verified
Your content is not used to improve base models and is not shared with model providers. Neither AWS nor the third-party providers use Bedrock inputs or outputs to train any model.; Whether the vendor may use your prompts and outputs to train models. “Not published” means we could not find any position, which is not the same as a no — ask for it in writing.
Where it runs, and what you can pin Region and residency control: Content is encrypted and stored at rest in the region where you use Bedrock. Cross-region inference moves retained data to the processing region. PrivateLink reaches into your VPC, but the service itself is not customer-hosted. Not verified; Which regions are offered and whether you can force processing to stay in one. A global endpoint that silently picks a region is a different compliance story from an endpoint you pin yourself.
Where safety filters run Guardrail execution location: In the vendor’s cloud Not verified
Sensitive-information filters block or mask PII inside Bedrock, and can be called through the ApplyGuardrail API without invoking a model — but they run on AWS's side.; A filter that strips personal data only helps if it runs before the data leaves your boundary. If guardrails execute in the vendor’s cloud, the vendor has already received whatever you wanted redacted.
Who else touches the data Subprocessor list: https://aws.amazon.com/compliance/sub-processors/ Not verified; The published list of third parties the vendor passes your data to. No list means you cannot know the full chain, which most data-protection agreements require you to.
SOC 2 audited SOC 2 audited: Yes Verified 2 days ago; An independent audit of security controls. Enterprise buyers and their procurement teams routinely require it.
Will sign a HIPAA agreement HIPAA BAA: Yes Verified 2 days ago; Required before you may send protected health information through the service. Without a signed BAA, healthcare data is off limits.
GDPR commitments GDPR commitments: Yes Verified 2 days ago; Published data processing terms for handling personal data of people in the EU and UK.
Can keep data in the EU EU data residency: Not published Not verified; Requests can be processed inside the EU rather than routed to US infrastructure. Often the deciding constraint for European customers.
Does not retain your data Zero data retention: Yes Verified 2 days ago; Prompts and responses are not stored after the request completes. Sometimes a paid add-on rather than the default.
Strips personal data PII redaction: Yes Verified 2 days ago; Detects and removes identifiers such as names, emails, and card numbers before the request reaches the model provider.
Content guardrails Content guardrails: Yes Verified 2 days ago; Policy checks on inputs and outputs — blocking unsafe content, enforcing formats, or catching prompt-injection attempts.
Runs fully disconnected Air-gapped deployment: Not published Not verified; Can be deployed in a network with no internet access, which some regulated and defence environments require.
Blocks personal data in prompts PII / DLP enforcement: Can block the request Not verified
Sensitive information filters detect PII entity types and custom regex entities, with per-entity behaviour of `BLOCK` or `MASK` on both input and output ([Sensitive information filters](https://docs.aws.amazon.com/bedrock/latest/userguide/guardrails-sensitive-filters.html), [Guardrail components](https://docs.aws.amazon.com/bedrock/latest/userguide/guardrails-components.html)); Whether personal data detection sits on the request path and can stop the call, merely inspects and forwards it, or is not documented. A control that only reports is a logging feature, not a policy control.
Blocks prompt injection Injection / jailbreak enforcement: Can block the request Not verified
"Prompt attack" is one of the content-filter categories with configurable strength thresholds; the detection mechanism is an AWS-managed classifier and is not described in detail ([Guardrail components](https://docs.aws.amazon.com/bedrock/latest/userguide/guardrails-components.html), [IAM policy-based enforcement](https://aws.amazon.com/blogs/machine-learning/amazon-bedrock-guardrails-announces-iam-policy-based-enforcement-to-deliver-safe-ai-interactions/)); Whether injection and jailbreak detection can stop a request. Most products offering this call a partner classifier rather than shipping their own.
Blocks harmful content Toxicity / moderation enforcement: Can block the request Not verified
Content filters cover hate, insults, sexual, violence, misconduct, and prompt attacks, with configurable thresholds applied to prompts and responses ([Guardrail components](https://docs.aws.amazon.com/bedrock/latest/userguide/guardrails-components.html)); Whether hate, violence, sexual and self-harm categories are checked inline and can stop a request, in either direction.
Your own policy rules Custom policy hooks: Can block the request Not verified
Customer policy forms are denied topics (natural-language topic definitions), word filters including custom word/phrase lists (profanity, competitor names), custom regex entities, and Automated Reasoning checks for policy validation ([Guardrail components](https://docs.aws.amazon.com/bedrock/latest/userguide/guardrails-components.html), [IAM policy-based enforcement](https://aws.amazon.com/blogs/machine-learning/amazon-bedrock-guardrails-announces-iam-policy-based-enforcement-to-deliver-safe-ai-interactions/)); Whether you can add your own rule — a regex, a webhook, or your own classifier — rather than choosing from the vendor library.
Where guardrails run Guardrail execution location: On the vendor's servers Not verified; Whether guardrail evaluation happens inside your infrastructure or on the vendor’s servers. This decides whether the prompt you are trying to protect leaves your network in order to be checked.
If the guardrail itself fails Guardrail failure mode: Not documented Not verified
No documented timeout/fail-open behaviour for the guardrail evaluation itself ([Guardrail components](https://docs.aws.amazon.com/bedrock/latest/userguide/guardrails-components.html)); What happens when the guardrail service times out or errors: does the request proceed unchecked, or is it blocked? This is the worst-documented field in the entire catalogue — only two vendors state it plainly, which means most teams are running a control whose failure behaviour they cannot know.
Third-party guardrail vendors Guardrail integrations: Not published Not verified; Named external guardrail services the product can call. A long list means the product is a router for policy engines rather than a policy engine itself — which also means another vendor bill and another hop.

Compliance evidence

Graded by how strong the evidence is, not whether the word appears on the vendor’s website. An audited report and a marketing claim are different things, and only one of them will satisfy your own auditor.

SOC 2 Certified in scope for SOC 1, 2 and 3
ISO 27001 Certified in scope, alongside 27017, 27018, 27701 and others
GDPR DPA Certified AWS DPA and subprocessor notice
HIPAA BAA Certified HIPAA-eligible; standard BAA available
FedRAMP Certified Moderate/Class C in commercial regions; High/Class D in GovCloud
ITAR Not published

Vendor source

Fit & integration

Work to try it Evaluation work shape: Set it up in a cloud console Not verified; The shape of the work on the vendor’s own quickstart, from swapping one base URL through to deploying infrastructure. An ordinal class rather than a duration, because elapsed time depends on accounts and quota we cannot see.
Work to run it Production work shape: Set it up in a cloud console Not verified; The same scale applied to the vendor’s recommended production path. For several products this is much heavier than the quickstart, which is exactly why both are recorded.
Steps on the quickstart Numbered quickstart steps: 5 Not verified; A literal count of numbered steps on the vendor’s quickstart, recorded as evidence beside the work shape. Zero means the page publishes no numbered procedure at all. Large counts usually mean interleaved language tracks rather than more work.
Can you self-host it today Self-host install documentation: No self-hosting Not verified; Whether an install command is actually published. Several products advertise self-hosting while publishing no command to start from, which a plain yes/no would hide.
Works with the OpenAI SDK OpenAI SDK drop-in: Yes Not verified
Yes. Existing OpenAI SDKs can be used by changing the base URL and API key. Documented base URLs are `https://bedrock-runtime.<your-region>.amazonaws.com/openai/v1` (recommended for new applications) and `https://bedrock-mantle.<your-region>.api.aws/v1`; the OpenAI SDK requires an Amazon Bedrock API key. ([Amazon Bedrock OpenAI-compatible APIs](https://docs.aws.amazon.com/bedrock/latest/userguide/bedrock-mantle.html)); Whether an existing OpenAI-compatible client can be pointed at it by changing the base URL and key.
Vercel AI SDK support AI SDK provider package: Official provider package Not verified
Per an AWS Vercel case study, Vercel AI SDK integrates with Amazon Bedrock through the dedicated provider package `@ai-sdk/amazon-bedrock`. ([AWS Vercel case study](https://aws.amazon.com/solutions/case-studies/vercel-case-study/)); Whether a first-party AI SDK provider package exists, or only a community package, a documented workaround, or the generic OpenAI provider pointed at a custom base URL.
Python framework integrations Documented Python frameworks: LlamaIndex, Strands Not verified
LlamaIndex integrations are documented for Amazon Bedrock, including `Bedrock`, `BedrockEmbedding`, `AmazonKnowledgeBasesRetriever`, `RouterQueryEngine`, `SubQuestionQueryEngine`, and `ReActAgent`. AWS Strands is also explicitly documented as a supported agent framework for AgentCore Runtime. ([LlamaIndex and Amazon Bedrock RAG](https://aws.amazon.com/blogs/machine-learning/build-powerful-rag-pipelines-with-llamaindex-and-amazon-bedrock/)); LangChain, LangGraph, LlamaIndex and similar orchestration frameworks with a documented integration.
Callable from Cloudflare Workers Cloudflare Workers support: Documented by Cloudflare, not the vendor Not verified
Documented by Cloudflare: Bedrock can be called from a Cloudflare Worker through Cloudflare AI Gateway using the `aws4fetch` library for client-side AWS SigV4 signing. ([Cloudflare AI Gateway - Amazon Bedrock provider](https://developers.cloudflare.com/ai-gateway/usage/providers/bedrock/)); Whether the docs show calling this product from your own Worker. Deliberately separated from the several products whose own gateway runs on Workers, which is a fact about their infrastructure and not about your edge compatibility.
Kubernetes install Helm chart availability: Only generic cluster docs Not verified
Amazon EKS documentation describes Helm for installing and managing charts, including charts from the `eks-charts` GitHub repository or ArtifactHub. No official Amazon Bedrock gateway Helm chart or operator is documented. ([Helm on Amazon EKS](https://docs.aws.amazon.com/eks/latest/userguide/helm.html)); Whether a named, published Helm chart exists, versus Helm being referenced with no chart named, versus generic cluster documentation that has nothing to do with this product.
Terraform support Terraform provider or modules: Resources in the cloud’s provider Not verified
The HashiCorp AWS provider documents the Terraform resource `aws_bedrockagentcore_registry`. The resource is deprecated; the evidence states that functionality will move from the `bedrock-agentcore` namespace to `agent-registry` on August 6, 2026, while the resource continues to work until September 17, 2026. ([Terraform AWS AgentCore Registry resource](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/bedrockagentcore_registry)); Whether you can declare this in code: an official provider, official modules, resources inside a hyperscaler’s provider, a community provider, or only Terraform code shipped in a repo.
Reuses your cloud identity Cloud IAM reuse: Reuses your cloud identity Not verified
Amazon Bedrock supports AWS credentials for HTTP requests, while OpenAI SDK usage requires an Amazon Bedrock API key. For AgentCore Gateway, IAM SigV4 is the default inbound authorization mechanism and IAM-based authentication is supported. ([Amazon Bedrock authentication and endpoints](https://docs.aws.amazon.com/bedrock/latest/userguide/bedrock-mantle.html)); Whether you can authenticate with IAM roles, workload identity or managed identities instead of another long-lived API key. Distinguished from products that only accept static upstream provider credentials.
Fits behind your API gateway API gateway integration: The cloud ships its own AI gateway Not verified
Amazon Bedrock AgentCore Gateway is the documented gateway platform. The evidence does not document Kong, APISIX, Envoy, Istio, or nginx gateway plugins for Amazon Bedrock. ([AgentCore Gateway MCP server](https://docs.aws.amazon.com/prescriptive-guidance/latest/semantic-layer-agentic-ai-ontology-reasoning-virtual-knowledge-graph/mcp-server.html)); Whether AI traffic can go through a gateway you already run, and who documented that — the product’s vendor or the gateway’s.
MCP support MCP surface shape: MCP tools in the API Not verified
Amazon Bedrock AgentCore supports MCP Streamable HTTP transport, normally with `stateless_http=True`; the `/mcp` endpoint supports MCP RPC messages, tool invocation and management, capability discovery, resource access, and multi-step workflows. Stateful sessions use the `Mcp-Session-Id` header, and the required container port is `8000`. ([AgentCore Runtime MCP protocol contract](https://docs.aws.amazon.com/bedrock-agentcore/latest/devguide/runtime-mcp-protocol-contract.html)); Which kind of MCP support this is: a gateway that governs many MCP servers, a hosted MCP server you connect to, MCP tools accepted inside the completion API, or client tooling. These are different products behind one acronym.
Needs your own provider key Upstream provider key required: Not needed Not verified
No. Authentication uses a Bedrock short-term API key generated in the console ([Quickstart - Amazon Bedrock](https://docs.aws.amazon.com/bedrock/latest/userguide/getting-started.html)); Whether an upstream provider account and key must exist before your first call works. A prerequisite rather than a step, and it can differ between the hosted and self-hosted forms of the same product.
Gate before models work Model access gate: Approval required Not verified
Yes, partly automated: "Access to all Amazon Bedrock foundation models is enabled by default with the correct AWS Marketplace permissions" and "When you invoke a third-party model for the first time in your account, Amazon Bedrock automatically initiates the subscription process in the background"; Anthropic models require a First Time Use (FTU) form (companyName, companyWebsite, intendedUsers, industryOption, useCases) after which "Access to the model is granted immediately after use case details are successfully submitted"; subscription setup "may take up to 15 minutes." GovCloud console access is a 10-step procedure ending "the Access status changes to Access granted or Available to request," and a 5-step programmatic procedure exists ([Request access to models - Amazon Bedrock](https://docs.aws.amazon.com/bedrock/latest/userguide/model-access.html)). Non-GA models are gated: "Access to Claude Mythos 5 and Claude Mythos Preview is gated and requires approval. Contact your Anthropic account team to request access on Bedrock." ([Amazon Bedrock Pricing](https://aws.amazon.com/bedrock/pricing/)); Whether an enablement click, a quota grant, a paid tier or an approval form stands between a valid key and a working model call.
Official client languages First-party client SDK languages: C++, Go, Java, JavaScript, Kotlin, .NET, PHP, PowerShell, Python, Ruby, Rust, SAP ABAP, Swift Not verified
The OpenAI Python SDK is documented with `from openai import OpenAI`; the examples require Python 3.7 or later and use `pip install openai boto3`. AWS SDKs are available for C++, Go, Java, JavaScript, Kotlin, .NET, PHP, PowerShell, Python/Boto3, Ruby, Rust, SAP ABAP, and Swift; the JavaScript v3 Bedrock Runtime package is `@aws-sdk/client-bedrock-runtime`, with classes including `BedrockRuntimeClient`, `ConverseCommand`, `ConverseStreamCommand`, and `InvokeModelCommand`. ([Amazon Bedrock SDK general information](https://docs.aws.amazon.com/bedrock/latest/userguide/sdk-general-information-section.html)); Languages with a first-party client library. An empty list can still mean the product is usable from any language via an OpenAI-compatible SDK.

Additional charges

These are the fees that do not appear on a per-token price list, and they are where estimates usually go wrong.

Intelligent Prompt Routing $1.00 per 1,000 requests
Guardrails content filters $0.15 per 1,000 text units
Guardrails sensitive information filter $0.10 per 1,000 text units
Guardrails Automated Reasoning checks $0.17 per 1,000 text units
Prompt Optimizer $0.03 per 1,000 tokens
Knowledge Bases vector index storage $5.00 per GB per month
Knowledge Bases Retrieve API $1.00 per 1,000 calls (Agentic Retrieval $4.00 per 1,000)
Human evaluation of model output $0.21 per task

How pricing actually works

Managed only, no self-host option. Bedrock sets its own per-token prices rather than marking up a third party: Standard, Flex and Batch (both 50% below Standard) and Priority (75% above Standard) tiers, plus Provisioned Throughput billed per model unit-hour with no-commitment, 1-month or 6-month terms.

Official links

Independent coverage

Third-party analysis, walkthroughs and operator threads. We link criticism as readily as praise. Nothing here is written or published by the vendor, by a competitor listed on this site, or by an SEO content farm — how we vet these.

Written reviews and analysis 2

The Engineering Guide to Amazon Bedrock Cost Optimization DoiT · Apr 2026 Third-party engineering guide covering Bedrock on-demand vs provisioned throughput, batch inference, intelligent prompt routing and prompt caching from customer engagements.
Amazon Bedrock vs. DIY approaches benchmarked Constellation Research · Dec 2024 Analyst writeup of Holger Mueller's benchmark comparing Bedrock's managed model access against do-it-yourself model hosting on cost and time-to-deploy.

Video 1

AWS Bedrock AgentCore - The Complete Beginners Guide YouTube - Johnny Chivers · Mar 2026 Independent AWS-focused channel deploys an agent to Bedrock AgentCore Runtime end to end and tests Gateway, Identity, Memory and cross-session behaviour.

Practitioner discussion 2

AWS Bedrock to require sharing data with Anthropic Hacker News · Jun 2026 Practitioners describe concrete blast radius of the data-sharing change: zero-data-retention contract clauses, regulated-industry escalations, and cost comparisons with buying Anthropic directly.
AWS Bedrock in production: anyone else finding it a mixed bag? Reddit - r/aws · Jan 2026 28-comment thread from teams running Bedrock ~6 months, focused on throttling, capacity limits and prototypes breaking at scale including during the us-east-1 outage.

What has changed here

No tracked value on this page has moved since it was first researched. Every figure still carries its original citation and check date.

Read the head-to-head

These pairs have a written verdict, not just a table.

Amazon Bedrock vs Google Vertex AI Read the verdict → Amazon Bedrock vs Azure AI Foundry Read the verdict →

Usually weighed against

Amazon Bedrock vs Azure AI Foundry Compare → Amazon Bedrock vs Cloudflare AI Gateway Compare → Amazon Bedrock vs Google Vertex AI Compare →