AIP-C01 — frequently asked questions

Guardrails content filters and InvocationsIntervened measure policy interventions on unsafe content, not disparate recommendation outcomes across demographic groups; they cannot compute Clarify-style bias metrics.

Model evaluation jobs provide offline comparisons of prompt variants; they do not natively emit continuous demographic-group fairness metrics or trigger >15% CloudWatch alarms.

Content Filters target harmful categories like violence, whereas Custom Word Filters allow you to block specific business terms like competitor names precisely.

It restricts the model's ability to generate answers unless they are strongly supported by the provided reference documents, reducing hallucinations.

While effective, using Comprehend requires custom Lambda logic and orchestration, increasing maintenance. Bedrock Guardrails are native, centrally managed, and require less code.

It allows you to create variant prompts based on a base template, enabling specific instructions (like tone or format) for each unit without maintaining separate codebases.

It is broader than the eu.amazon.nova-pro-v1:0 profile and fails the precise access control requirement, even though it stays EU-scoped.

eu-west-3 is in the EU, but the existing SCP still explicitly denies the Bedrock invoke action there; CRI requires each destination Region to be allowed.

Provisioned concurrency keeps Lambda instances warm but still runs financial, sentiment, and compliance analysis sequentially; it reduces cold starts, not the 45-second critical path.

It can increase throughput, but it does not by itself orchestrate the three analysis types in parallel, and queue buffering adds latency to a strict 10-second per-batch SLA.

WAF filters HTTP-layer patterns but cannot semantically understand natural-language prompts; it also does not provide Bedrock guardrail intervention logs or cross-Region guardrail failover.

CloudTrail records AWS API calls, not detailed guardrail assessments or intervention events; CloudWatch Logs from Bedrock Guardrails is needed to audit safety decisions.

DynamoDB requires custom schema design and management, increasing operational overhead compared to simply logging to S3.

Knowledge Bases handles retrieval and attribution; the LLM (Claude) generates reasoning. The combination in Option A satisfies both via managed integration.

Semantic chunking splits text based on meaning, preserving context and reducing noise, whereas fixed-size chunking may break logical units.

It automates the retrieval of relevant chunks from a knowledge base and passes them to the model, simplifying application development.

Tagging supports audit classification, but an S3 object remains in its bucket's Region; you still need Region-scoped buckets and IAM, plus the PII redaction and Bedrock workflow supplied by A, B, and E.

It validates structured fields extracted from each document before Step Functions builds the Bedrock prompt; low-confidence extraction pages are routed to humans by Textract and A2I in option A.

Express workflows do not support .waitForTaskToken callback integrations, so they cannot pause durably for an ambiguous query to be resolved.

ElastiCache is an in-memory cache with optional persistence, not the durable system of record needed for personalization; DynamoDB on-demand provides durable, encrypted storage.

No, Bedrock Flows does not have native S3 action nodes for reading/writing objects; use Step Functions for such integrations.

Step Functions is better for linear, deterministic workflows with specific I/O requirements, whereas Agents are for conversational, intent-based interactions.

A circuit breaker prevents cascading failures by temporarily halting requests when error rates spike, protecting the backend service from being overwhelmed during sustained outages.

It buffers successfully received data and reconnects only from the last known good point, avoiding redundant processing and ensuring complete responses despite network interruptions.

HTTP APIs do not natively support Lambda response streaming, so you would need a Lambda Function URL proxy or similar workaround, which adds configuration and overhead.

Yes. AWS added REST API response streaming, enabling a streaming Lambda integration to deliver Amazon Bedrock output progressively to the client.

Detecting PII only flags it; unless the message is blocked or entities are redacted, sensitive customer data can still reach the Bedrock FM, failing the privacy requirement.

No. Toxicity detection, prompt safety classification, and PII redaction can run in parallel as long as every filter finishes before the Bedrock FM receives the draft request.

A NAT gateway only masks private IPs while traffic still exits to the public bedrock-runtime endpoint over the internet, so it fails the PrivateLink/private-connectivity requirement.

A permissions boundary only sets the maximum permissions an identity can have; access still requires an identity policy that allows the specific ModelId ARNs.

It can compute cosine similarity, but you must build and maintain the workflow states, similarity logic, and DynamoDB schema yourself, which is far more operational complexity than the managed evaluation job the question prioritizes.

The requirements state low-confidence requests must be processed asynchronously. A synchronous escalation blocks the request path, adding latency and coupling availability of the expensive model to every response.

Invoking both models for every request defeats the stated cost-optimization goal, since the larger, more expensive Bedrock model would run 100% of the time regardless of the small model's confidence score.

The question requires blocking harmful prompts before model invocations; option C skips that step, so unsafe inputs still reach and consume the foundation model.

A bedrock:GuardrailIdentifier IAM condition makes it impossible to invoke a model without a guardrail, so every inference is guaranteed to comply with the approved policy.

It builds a pre-processing pipeline over S3 that must be scheduled and maintained, and it only masks data before the FM runs — it does not ensure PII is masked in the FM's response, which is what the question requires.

No. Macie discovers and classifies sensitive data in S3; it does not filter or mask content flowing in and out of a model, so it cannot meet the FM-response masking requirement.

Guardrails word, topic, and pattern rules match explicit strings, not meaning; catching fabricated treatments requires evaluation against validated clinical references.

Feature Store is built for storing and serving ML feature vectors, not for maintaining a document repository of clinical guidelines used to validate model responses.

Option A detects anomalies only via scheduled Athena queries on CloudTrail logs, which is batch, not real-time. It also lacks A/B testing and continuous model performance tracking that option C provides.

S3 Object Lock provides write-once, tamper-evident (WORM) storage required for regulated audit retention, ensuring feedback, flagged events, and logs cannot be altered or deleted.

A knowledge base delegates storage and retrieval to an external vector engine and exposes no "custom vector partitioning" setting. It adds abstraction without adding the cluster capacity the workload needs.

DynamoDB has no native approximate nearest-neighbor query operator, and features like "sparse vector compression" do not exist. Streams and Lambda can keep data in sync but cannot execute vector similarity retrieval.

Guardrails sensitive-information filters act on model interactions, but they do not redact records already written to storage, do not make logs immutable, and do not enforce healthcare retention periods.

Compliance mode is write-once-read-many and blocks deletion or overwrite even by administrators, guaranteeing the prompt-completion record stays intact for the full retention window.

Macie is designed for data discovery and classification at rest. It is not optimized for real-time inference filtering, making Bedrock Guardrails a more direct and less overhead-intensive solution.

Few-shot prompting provides consistent, standardized examples to guide the model, reducing variability. Dynamic prompts require complex logic to adapt to schemas, increasing operational overhead.

RAM shares resources, not the end user's credentials; even if a table were shared, DynamoDB access would not carry the per-user session tags needed for a full audit trail.

SCPs only define the maximum permissions for accounts in Organizations; they do not grant permissions or create cross-account trust. AgentCore still needs an assumed IAM role in each account.

The offending identifiers are generated by the model, not carried over from inputs, since all detected input entities were already replaced with tokens before Bedrock was called.

Guardrails return block reasons and content filter metadata for every PII handling decision, and they run as a lightweight stream filter rather than a second full inference pass.

The violent and inaccurate text is generated by Nova Pro during inference, not typed by the children. Only output-side content filters can inspect and block that generated content.

No. A lower temperature reduces randomness and historical hallucination but never guarantees blocking. You still need guardrails set to High strength with the block action.

A cross-encoder reranker rescores every candidate by jointly evaluating the query and each document, so relevant items buried by vector similarity move into the top 10 returned to the FM.

Cosine similarity over the same embeddings is what vector retrieval already uses, so re-sorting by it changes nothing while adding Lambda latency that risks the 3-second response target.

EC2 forces you to build and patch GPU fleets, orchestrate model updates per country, and manually move insights for analysis, creating far more operational work than managed Outposts and Wavelength.

A single Region-hosted endpoint adds cross-continent round-trip time for remote clinics, so latency targets cannot be met regardless of any Global Accelerator improvement.

Option A's DynamoDB approach is valid but requires custom logic to evaluate the 10%/60-second threshold. CloudWatch alarms natively detect this and EventBridge automates switching, reducing complexity.

Yes. When the CloudWatch alarm returns to OK, the EventBridge rule can trigger a state transition back to the normal Bedrock path, satisfying the automatic-recovery requirement.

S3 policies and object tags apply to whole objects and paths, not to fields within a row or file. Only Lake Formation permission grants can restrict access to individual data columns.

Option C deploys the FM on SageMaker AI so the execution role in Account C can assume the source-account roles and read through Lake Formation. Bedrock's cross-account roles alone would not deliver column-level grants.

It looks simpler today, but every new internal and external system becomes another tool in one agent's prompt, so complexity, prompt bloat, and failure impact grow unbounded—breaking the modular-growth requirement.

Step Functions pauses the workflow using a callback token, waits for an approver to approve or reject the optimization, then resumes or terminates the run with a durable, auditable record.

A global inference profile may route a request to any supported Region, including US-based ones, so European customer data could be processed outside the EU and breach the stated residency requirement.

It is a cross-Region inference profile with a geography prefix such as eu. or us. that keeps all inference routing and processing inside that geography's AWS Regions.

AccessDenied occurs when sts:AssumeRole is refused, before any dataset or FM is used. Dataset and metric mismatches raise validation errors instead, so only the missing trust policy (A) resolves it.

CORS is a set of XML rules on the bucket controlling which browser origins may issue HTTP requests; IAM policies govern AWS API authorization. A Bedrock evaluation job uses the SDK, so CORS (B) is irrelevant.

Dimensions affect representational capacity, not lexical matching. If a medical acronym or exact term is not captured by the dense vector, a larger embedding may still rank semantically similar but wrong documents, while hybrid search adds explicit keyword scoring.

Kendra is more defensible when managed enterprise search, built-in connectors, or query expansion are primary requirements and migration overhead is acceptable. A SageMaker re-ranker helps when top-tier precision matters more than added latency and model-hosting effort; here those costs conflict with least operational overhead.

Tune the relative weights or normalization between lexical and vector scores, validate on a medical query set with acronyms and exact terms, and track recall plus p95 latency as the index grows to millions of documents.

A prompt can tell Claude to use only the catalog, but it does not supply a live, authoritative product list. With mostly unique interactions, RAG retrieves current catalog items and grounds each response.

Most customer interactions are unique, so cache hit rates would be low. Caching also does not make an ungrounded recommendation relevant or available, and post-generation validation adds latency.

The latency-optimized setting in option C targets slow knowledge base retrieval and generation, while RAG grounds Claude in the current product catalog.

DynamoDB relies on exact key matches. It cannot natively perform vector similarity searches to find semantically equivalent queries without additional complex logic or external tools.

Approximate k-NN uses algorithms like HNSW to quickly find the closest vector neighbors in large datasets, offering a good balance between accuracy and low latency for real-time applications.

API Gateway adds management overhead. Lambda Function URLs provide a direct HTTPS endpoint with no additional service to configure, making them simpler for single-function deployments.

Yes, SigV4 is AWS's standard authentication protocol. It ensures that only authorized IAM roles/users can invoke the function, providing strict access control.

It is a transport layer for MCP that supports long-running connections and chunked data transfer, ideal for stateless serverless functions like Lambda.

Block filtering denies the entire request if prohibited content is detected, effectively preventing the output. Mask filtering identifies sensitive data (like PII) and replaces it with placeholders, but the request is still processed.

SCPs provide centralized control across all accounts in an AWS Organization, ensuring consistent policy enforcement regardless of individual account IAM settings. They are more scalable for multi-account governance than managing boundaries on every role.

No. S3 Event Notifications can only be sent to SNS, SQS, or EventBridge. EventBridge is typically used to trigger Step Functions workflows based on S3 events.

Step Functions have a 256 KiB payload limit. Large transcripts from 20 MB MP3s may exceed this. Lambda allows fetching the file from S3, constructing the prompt, and calling Bedrock without hitting state payload limits.