The one that trips people up is the third. Choosing a Region settles residency for a single-Region workload, and a cross-Region inference profile is the setting that quietly stops that being true, along with a log group nobody gave an expiry to.
Read the five facts as a division of labour. AWS answers what the service does with the bytes. You answer who may send them, where the copies land, and how long they stay. Walking a real feature through every copy it leaves behind shows how little of that second half survives choosing a Region and stopping there. On the professional track, the same properties get weighed against throughput and cost at a depth this level does not ask for.
Flash card
What Amazon Bedrock does with a prompt and the completion it returns: the customer's half of the AWS shared responsibility model for a generative AI feature, covering training use, encryption, residency and logging.
- Bedrock does not use your prompts or your completions to train the base foundation models, and it does not share them with the model provider whose model you called. The base model is fixed at the moment you invoke it. Your text is processed, answered and discarded. The next customer to call that model gets one which has never seen it. Almost every wrong answer here starts from the opposite assumption.
- Prompts and completions are encrypted in transit with TLS on the way to the service and back. Where anything is stored, it is encrypted at rest with AWS Key Management Service [AWS KMS]. You can supply a customer managed key instead of taking the AWS managed one. That is what a scenario reaches for when the organisation must be able to revoke access to its own data independently of AWS. Encryption at rest and in transit is the phrase to recognise; on Bedrock both halves are already on.
- An inference request is processed in the AWS Region you called, which is the primary residency control and usually the whole answer. The exception is a cross-Region inference profile: switch one on for extra throughput and a request may be served from another Region inside that profile’s geography. That is the residency detail people miss, because nothing about the endpoint you call changes when it happens.
- Model invocation logging is opt-in and off by default. Turn it on and the full prompt and the full completion are written to an Amazon S3 bucket or an Amazon CloudWatch Logs group in your own account. That log becomes the most sensitive artefact in the workload, and it is yours to protect. Restrict who can read it, encrypt it with your own key, and set a retention period; a CloudWatch Logs group keeps its contents forever until somebody says otherwise. Logging is a governance requirement and a data-leakage risk at once.
- A fine-tuned or otherwise customised model is a private copy that lives in your account. The training data goes into that copy and nowhere else, the base model is unchanged by it, and no other customer can invoke it. Fine-tuning does not put your data into the public model, and the copy is billed and secured as your resource.
Pick it when
Reach for these five lines whenever a scenario asks whether a managed foundation model is safe to send regulated data to, or asks what the customer still has to do once they have chosen Bedrock. Under the AWS shared responsibility model, AWS runs the model, the hardware and the encryption of the service itself. You own the rest: the identity policies deciding who may invoke it, the key protecting any stored copy, whether logging is on and who can read the log, and the choice of Region and inference profile. The service answers the training question for you. It does not answer the access, retention or residency questions, and those are the ones an auditor asks.
It's the wrong answer when
None of this makes a prompt safe to write. Bedrock not training on your text says nothing about personal details ending up in a completion shown to the wrong person. That is a job for Amazon Bedrock Guardrails, and for what you put in the prompt in the first place. It says nothing about whether the request crossed the public internet, which is AWS PrivateLink and a virtual private cloud [VPC] endpoint. And it is not evidence: a compliance report about AWS’s own controls comes from AWS Artifact, while the record of who called which model and when comes from AWS CloudTrail.