The situation
A manufacturer runs four plants. Two of them sit in a country whose regulator treats plant maintenance records as critical-infrastructure data. The raw records, the sensor histories, the fault codes, and the engineers’ free-text notes must remain physically on the site that produced them. Not in-country. On site. The regulator has audited the manufacturer twice and asked both times where the records were stored, and the answer both times was a rack in the plant’s own server room.
The team wants a plant assistant over those records. A technician standing at a stopped line should be able to ask why this pump keeps tripping, and get back the three most similar past faults with what fixed them. The records that would ground the answer are precisely the records that cannot be exported.
There is a second use case attached to the same handheld. The device runs a live checklist that reads a tag, validates the entry, and confirms it before the technician’s thumb leaves the screen. The plant’s operations lead has put a number on it: under 20 milliseconds for the confirm, because anything slower and the technicians start double-tapping and the checklist data goes bad. That handheld runs on a mobile carrier’s 5G network that covers the site, not on the plant’s wired LAN.
The other two plants are in a jurisdiction with no such rule. The team would rather not build two entirely separate products.
What actually matters
“The data cannot leave” is never a single requirement, and the first useful move is to break the sentence into classes of bytes. There is the raw maintenance record, which the regulator named. There is derived text: a summary, a redacted excerpt, a fault code with the site identifier stripped. There is an embedding, which is a lossy numerical projection of text and is treated as a copy by some regulators and as a derivative by others. And there is the model’s answer, which may quote the source or may only describe it. A rule that pins the raw record does not automatically pin all four, and assuming it pins nothing else is how organisations end up in front of an auditor. Designing for data compliance across jurisdictions starts with a written answer, per class, on what may cross. That answer decides the architecture.
The second thing to separate is latency from generation. Sub-20 millisecond response and foundation-model inference are not in the same conversation. A model call typically runs to hundreds of milliseconds and often to seconds. Physical proximity does not change that. A first token that takes 400ms takes 400ms whether the model sits in a Region 30ms away or 3ms away. What the 20ms budget actually covers is the interactive layer: capturing the tag, validating the field, looking up a cached answer, and painting the confirmation. Those are the operations worth moving toward the user. Moving the model toward the user does very little for them and adds a rack somebody has to own.
Third, somebody has to own the hardware. Putting compute in the plant or at a carrier’s edge site means a physical footprint with a capital commitment behind it. It also means a maintenance window, a spares story, and a person whose job includes the rack. That expense is justified when it delivers a guarantee no Region can, and wasted when a Region in the same country would have satisfied the rule. Hybrid cloud architectures are justified by an obligation that cannot be met in a Region, not by a preference for local hardware.
Fourth, and this one settles most of the design: Amazon Bedrock is a Regional service. It does not run on an Outpost and it does not run at a Wavelength Zone. So the foundation model stays in a Region no matter what the rest of the architecture does, and everything that moves outward moves outward around it. What can sit on site is the record store, the retrieval index over it, the embedding of already-sanitised text, and a cache of answers already returned. So can the redaction and tokenisation step that turns a protected record into something safe to send. What cannot sit on site is the model. Cross-environment AI solutions are shaped by that asymmetry: the data goes to the edge, the inference does not follow it.
What we’ll filter on
- Which bytes cross. Does the design send a raw protected record over the boundary, or only text that has already been redacted or tokenised on site?
- Where the model runs. Does the option keep access to the managed foundation-model catalogue, or does it trade that away for local weights?
- Interactive latency. Can the sub-20ms confirm path be served without a round trip to a Region?
- Hardware and cost shape. Does the option add a rack somebody has to own, and is the residency guarantee worth that commitment?
- Routing and evidence. Is the path between the plant and the Region private, resolvable, and auditable, so a regulator can be shown what crossed?
The landscape
An in-country Region reached over PrivateLink
The lightest option: run everything in an AWS Region inside the same country, and keep the record store in Amazon S3 under a customer-managed KMS key. Bedrock is reached from a VPC over an interface VPC endpoint, so the traffic never touches the public internet. This is the standard secure posture, covered in the four planes of a Bedrock deployment, and for the two plants in the permissive jurisdiction it is the whole answer.
It fails the strict jurisdiction on one word. The regulator said on site, and an in-country Region is not on site. Region choice satisfies residency rules written at the level of the country; it does nothing for a rule written at the level of the building.
AWS Outposts in the plant
AWS Outposts for on-premises data integration puts an AWS-managed rack in the plant’s own server room, running AWS services on hardware that physically sits inside the boundary the regulator drew. The records land in local storage. A retrieval index over them runs on local compute. The redaction step runs there too, stripping site identifiers, employee names, and serial numbers. What leaves the plant has already had the protected fields removed or swapped for tokens whose mapping stays behind. The Outpost connects back to its parent Region over the service link, an encrypted set of VPN connections carrying both management traffic and the VPC traffic between the rack and the Region. AWS asks for redundant connectivity of at least 500 Mbps per compute rack and a round trip to the Region under 175ms. That makes secure routing between cloud and on-premises resources a configuration rather than a bespoke build, because Outpost subnets sit in the same VPC as the Regional ones.
What Outposts does not give you is Bedrock. The foundation models are not part of the service catalogue that runs on an Outpost, so the generation step still leaves for the Region. The rack holds the data and the sanitising step; the Region holds the model.
AWS Wavelength at the carrier edge
AWS Wavelength to perform edge deployments places compute inside a telecommunications provider’s 4G or 5G network. A carrier gateway attaches the Wavelength subnet to that carrier’s network, so traffic from a handset on it reaches the application without backhauling to a Region. Read the other way, that is also the constraint: only devices on the carrier’s network arrive through the carrier gateway, which accepts no inbound connections from the internet at all. A handheld on the plant’s own wireless LAN cannot be served this way, and the device fleet has to be on the carrier that hosts the zone. The application code running there is an ordinary EC2 instance or container: the tag validation, the field checks, the cached-answer lookup, the response the technician actually feels.
Wavelength has the same limit as Outposts on the model. Bedrock is not available in a Wavelength Zone, so nothing there generates anything. It serves the interactive layer, and it hands the slow path onward.
Self-hosting an open-weight model on local hardware
The remaining option is to stop using a managed model at all. An open-weight model runs on GPU capacity in the plant, on EC2 instances on the Outpost or on containers scheduled there, and generation happens inside the boundary with everything else. This is the only option where a protected record can reach a model verbatim.
Most of what you give up is not money. The managed catalogue goes, so switching models becomes a redeployment rather than a configuration change. The technique in keeping the model identifier out of the code path loses most of its value when there is one model and you built the box it runs on. You own capacity planning for GPUs in a building that was not designed as a data centre, and the accelerated instance family on an Outposts rack is G4dn, which puts a hard ceiling on the size of model you can serve. You own model updates, security patching, and evaluation of every new version yourself. It is a real answer for a genuinely absolute rule, and an expensive mistake when redaction would have been enough.
The trap in the routing layer
One configuration deserves naming because it is easy to switch on and directly violates a residency rule. A cross-Region Inference profileA Bedrock resource wrapping a model so calls to it can be tagged, routed across regions, or repointed without changing app code. spreads Bedrock invocations across several Regions to absorb bursts, which serves throughput and breaks a jurisdictional rule. A geographic profile keeps processing inside a geography such as US, EU or APAC, which is wider than one country; a global profile can route to any supported commercial Region worldwide. Neither is narrow enough for a rule written about one country. Spreading load across Regions is a good default and a compliance breach here. The same caution covers the failover patterns in a multi-Region resilience design, because a failover into a Region outside the permitted jurisdiction breaches the rule at the moment the design is meant to be rescuing you. For the constrained plants, an application inference profile is created over the model in the single permitted Region, and the IAM policy denies any other. CloudTrail records where each request was actually processed in additionalEventData.inferenceRegion, which is how you show that the pin held.
For the routing itself, an Amazon Route 53 geolocation or IP-based record resolves the assistant’s name differently depending on where the caller is, so the handheld at a constrained plant reaches the local endpoint and one at an unconstrained plant reaches the Regional one. Amazon CloudFront fronts the static and cacheable parts of the interface, and AWS Global Accelerator gives the Regional endpoints a stable anycast address for the plants that talk to them directly.
Evaluation
Side by side
| Option | Raw records stay on site | Managed model catalogue | Serves the sub-20ms path | No local hardware to own | Private path to Bedrock |
|---|---|---|---|---|---|
| In-country Region + PrivateLink | ✗ | ✓ | ✗ | ✓ | ✓ |
| AWS Outposts in the plant | ✓ | ✓ (in the Region) | ✗ | ✗ | ✓ |
| AWS Wavelength at the carrier edge | ✗ | ✓ (in the Region) | ✓ | ✗ | ✓ |
| Open-weight model on local hardware | ✓ | ✗ | ✗ | ✗ | n/a |
No row wins. The first row is the cheapest and fails the rule that started the project. The last row satisfies the rule absolutely, gives up the catalogue and the upgrade path, and puts a GPU fleet in a factory. The two middle rows each solve one problem and neither solves the other, which is the signal to compose rather than select. Outposts answers the residency question, Wavelength answers the latency question, and the Region answers the generation question.
The solution
Put an Outpost in each constrained plant and give it the record store, the index, and the sanitising step. The maintenance records land in local storage on the rack and are never copied to a Regional bucket. The retrieval index over them runs on local compute, so a query about a tripping pump is answered by searching documents that never moved. The redaction and tokenisation step runs on the Outpost as well. A step that sanitises data has to execute on the safe side of the boundary; running it in the Region would mean the protected record had already crossed. Site identifiers, employee names, work-order numbers, and serial numbers are replaced with stable tokens, and the mapping table stays on the rack. A returned answer is re-expanded locally, and the real value never leaves the plant. The same substitution discipline covers the ground in keeping identifying data out of prompts and logs, applied to a jurisdictional boundary rather than a privacy one.
Send only the sanitised text to Bedrock in the in-country Region, over an interface VPC endpoint backed by AWS PrivateLink, from the VPC the Outpost extends. The prompt that leaves the plant contains a question, three tokenised excerpts, and nothing that identifies a site or a person. Model invocation logging is off until you enable it; switch it on and it captures the full request and response bodies, and that log is the evidence a regulator asks for: a record of exactly which bytes crossed, delivered to an S3 bucket encrypted under a customer-managed key. Separately, set the account’s Bedrock data retention mode to none, so no inference input or output is written to durable storage by AWS, and hold it there with a service control policy on the retention-mode condition key. Under cross-Region inference anything retained lands in whichever Region processed the request, which is the second reason to pin the profile and to deny every other Region in the application role’s IAM policy.
Run the handheld’s interactive layer at a Wavelength Zone on the plant’s carrier. Tag capture, field validation, the checklist state machine, and the answer cache all live there, close enough that the confirm lands inside the operations lead’s budget. When a technician asks a question the cache does not hold, the Wavelength component hands it back to the Outpost for retrieval and on to the Region for generation. The interface shows a longer request running rather than implying the answer is instant. Splitting the fast path from the slow path this way meets the 20ms budget where it applies and drops the claim where it does not.
Route by jurisdiction rather than by product. Route 53 resolves the assistant’s endpoint to the local path at a constrained plant and to the Regional path at an unconstrained one. CloudFront fronts the cacheable interface assets everywhere, and Global Accelerator gives the Regional endpoints one stable address. The application stays one codebase, with its retrieval and redaction layer configured per site. The two plants in the permissive jurisdiction run the plain Regional deployment; the constrained plants run the same code with the local store and the sanitising step switched on.
Leave the open-weight local model on the shelf. Revisit it only if the regulator’s position hardens from “the records must not leave” to “no derivative of the records may leave”. At that point there is nothing sanitised enough to send, and the model has to come to the data. Until then it gives up the catalogue and the upgrade path to solve a problem redaction already solves.
Worked example
A technician at a constrained plant stops at line 3 and asks the handheld why the transfer pump keeps tripping.
The keystrokes and the tag scan are handled at the Wavelength Zone. The tag is validated against the local asset list and the confirm paints without a round trip to the Region; the technician’s thumb is already off the screen. The cache is checked for this asset and this fault code, misses, and the request goes back to the plant.
On the Outpost, the retrieval index searches the plant’s maintenance history and returns three past work orders for the same pump. Those documents never leave local storage. The redaction step rewrites the three excerpts. The plant code becomes a token, the two engineers’ names become tokens, the serial number becomes a token, and the free-text notes are scanned for anything that identifies the site. What comes out is three paragraphs about a pump that trips on high discharge pressure after a filter change, with no way to tell which pump or where.
That sanitised text plus the technician’s question travels the interface VPC endpoint to Bedrock in the in-country Region. The prompt carries three anonymised histories. The response says the trips follow filter changes, that two were resolved by re-priming before restart, and that the third came down to a stuck check valve. The response comes back over the same private path.
Back on the Outpost, the tokens in the answer expand to the real work-order numbers so the technician can open them. The exchange is written to a local audit record alongside the Regional invocation log. The next audit shows the regulator two things: the records still sitting on the rack in the plant, and a log of every prompt that crossed the boundary. Nothing identifying appears in any of them.
What’s worth remembering
- Break “the data cannot leave” into raw records, derived text, embeddings, and answers, then get a written ruling per class: a rule pinning the raw record may still permit sanitised text to cross.
- Amazon Bedrock runs only in Regions, so an on-premises or edge design moves the data, the redaction step, the index, and the cache outward, and leaves the foundation model where it is.
- AWS Outposts answers a rule written at the level of the building, which Region selection cannot; use it when in-country is genuinely not enough, and expect to own a rack.
- AWS Wavelength serves the interactive layer a person actually feels rather than generation, and it reaches only devices attached to the carrier network that hosts the zone.
- A cross-Region inference profile, geographic or global, and any multi-Region failover will route invocations outside a permitted jurisdiction; pin an application profile to one Region, deny the rest in IAM, and set data retention to none.
- Redaction and tokenisation have to execute on the protected side of the boundary, and the invocation log of what crossed is the evidence an auditor will ask to see.