Exam-style
An Australian insurer runs a customer service assistant on Amazon Bedrock, deployed in the ap-southeast-2 Region because a contract requires that customer data stay in Australia. Legal asks the team to confirm in writing that the requirement is met. What should they say?
Reveal the answer
B. The Region choice is necessary but not sufficient. A cross-Region inference profile can process a request in another Region, CloudWatch Logs stores data indefinitely by default, and copies taken for evaluation or support can land in a bucket elsewhere
Choosing the Region settles where the model is invoked and where the buckets sit. A generative AI feature leaves a fresh copy at each stage, and three of them escape the Region setting. A cross-Region inference profile routes the request elsewhere: a geographic profile stays inside APAC, which spans Regions well outside Australia; a global profile can be processed in any commercial Region. Prompts and outputs AWS retains are stored in the Region that processed them. CloudWatch Logs stores data indefinitely unless a retention period is set, so prompt and completion logging becomes the longest-lived copy. A copy taken for evaluation, fine-tuning or support lands wherever the person put it. The third option overshoots: Bedrock does not share content with model providers, and the account’s data retention mode governs what AWS keeps, so the service is usable here. Encryption and an Artifact report are both worth having and neither says where the bytes are. KMS controls who can read a copy, not which country holds it; Artifact documents AWS’s own controls, not this workload.
Q. The assistant is deployed in ap-southeast-2 because customer data must stay in Australia. Legal wants that confirmed. Is the Region enough?
A. No. The Region choice is necessary and not sufficient. Check the inference profile, the log retention, and the copies people take.
Why? Residency is about where each copy of the data physically sits, and a generative AI feature makes a copy at every stage: prompt, retrieved passage, completion, log line. The Region setting covers the stored copies and misses three routes out. A cross-Region inference profile tied to a geography routes the request anywhere in APAC, and a global profile routes it to any commercial Region. Retained prompts and outputs are stored where the request was processed, so confirm which profile is in use, or call the model in-Region. CloudWatch Logs stores data indefinitely unless a retention period is set, which makes the log group the longest-lived copy. Copies taken for evaluation, fine-tuning or a support case need buckets already in the right Region, with lifecycle rules that expire them on a schedule nobody has to remember. An AWS Config rule watching the log groups and the buckets is how the team finds out when one of those assumptions stops being true; write a custom one, because the managed retention check marks “Never expire” as compliant.