← Agent Frameworks 🕐 17 min read
Agent Frameworks

Bedrock Privacy, Compliance Controls, and Security Cost Overhead (2026)

Summary · March 2026

Amazon Bedrock's compliance posture is stronger than most enterprise AI alternatives by default — customer data is contractually excluded from model training, encryption is always-on in transit, and t

Amazon Bedrock’s compliance posture is stronger than most enterprise AI alternatives by default — customer data is contractually excluded from model training, encryption is always-on in transit, and the service is covered under AWS’s existing BAAs, SOC 2 Type II, and ISO 27001/27017/27018 certifications. But “HIPAA-eligible” does not mean “HIPAA-compliant.” Operationalizing the compliance posture requires deliberate configuration of VPC isolation, customer-managed encryption keys, audit logging, and guardrails. Each of those controls has a real cost that compounds. A HIPAA-compliant Bedrock deployment running at moderate scale adds roughly $800–$1,200/month in security infrastructure overhead before touching model inference costs. This note quantifies each layer, identifies where the gaps are, and provides IAM/SCP patterns for enforcement.

1. Data Isolation: What AWS Actually Guarantees

AWS’s contractual commitment on customer data is unambiguous and covers all models:

“Your content is not used to improve the base models and is not shared with any model providers. Amazon Bedrock doesn’t store customer input data and model output data, share the data with third-party model providers, or use the data to train models.”

This applies to standard API inference — InvokeModel, Converse, InvokeModelWithResponseStream. It does not automatically apply to:

  • Knowledge Bases (vector store indexes data you provide)
  • Fine-tuning / continued pre-training (training data is explicitly stored)
  • Model invocation logging (when enabled, full prompts and responses are written to S3 or CloudWatch Logs)

The architecture enforces isolation at the infrastructure level: AWS deploys a dedicated model-serving account per model provider, and model providers have zero access to those accounts. All invocation traffic stays within the AWS network — it does not traverse the public internet unless your VPC routes it that way.

CloudWatch Default Logging

Model invocation logging is disabled by default. When you enable it, Bedrock writes structured records to your chosen destination (S3, CloudWatch Logs, or both) containing:

  • Full request payload (prompt, system prompt, parameters)
  • Full response payload
  • Invocation metadata: model ID, timestamp, latency, token counts, request ID

CloudTrail records that an API call occurred but omits content. Invocation logging adds the content. For compliance audits — HIPAA especially — you need invocation logging, not just CloudTrail. The distinction matters for cost sizing.

To disable invocation logging: Navigate to Bedrock Console → Settings → Model invocation logging and toggle off. Via CLI: aws bedrock delete-model-invocation-logging-configuration. Note that disabling logging breaks audit trails for regulated workloads — the right answer is selective enablement with appropriate retention policies, not blanket disablement.

For workloads involving PII, PHI, or financial data, sending Bedrock traffic through public internet (even TLS-encrypted) fails most enterprise security reviews. PrivateLink creates a private connectivity path from your VPC to the Bedrock service endpoint without traversing internet gateways or NAT.

Required configurations for regulated data:

  • HIPAA: Network isolation via VPC interface endpoints is a required technical safeguard under the Security Rule (45 CFR § 164.312(e))
  • PCI-DSS: Requirement 1 mandates network segmentation; routing cardholder data through public endpoints fails this
  • SOC 2 CC6.1: Logical access controls must include network boundary protection

Pricing

Component Cost
Interface endpoint (PrivateLink) $0.01/hour per AZ
Data processing $0.01/GB transferred through endpoint
S3 Gateway endpoint (for log storage) Free

For a 2-AZ production deployment: $0.01 × 2 × 730 hours = $14.60/month in endpoint hours. Data processing charges at $0.01/GB are negligible for typical API payloads (most requests are kilobytes, not megabytes). At 100 GB/month of Bedrock traffic, data processing adds $1.00.

PrivateLink vs. NAT Gateway economics: If your VPC currently uses a NAT Gateway to reach Bedrock ($0.045/hour + $0.045/GB), switching to PrivateLink pays for itself at roughly 400 GB/month of throughput. For high-volume workloads, PrivateLink reduces total networking cost even absent compliance requirements.

Performance Implications

PrivateLink adds negligible latency — AWS measures it at under 1ms within a region. The more significant consideration is throughput: interface endpoints are limited to a single AZ’s bandwidth per ENI. For high-concurrency Bedrock workloads, deploy one endpoint per AZ to avoid hotspots.

3. Encryption: CMK vs. AWS-Managed Keys

Default Encryption

All Bedrock data at rest (fine-tuning data, Knowledge Base vectors, invocation logs) is encrypted by default using AWS-owned keys. In transit, TLS 1.2+ is enforced on all endpoints. AWS-managed keys are free.

Customer-Managed Keys (CMK)

CMK via AWS KMS provides:

  1. Audit trail of every encrypt/decrypt operation via CloudTrail
  2. Key revocation — disabling the CMK immediately renders all encrypted data inaccessible
  3. Key rotation control — annual rotation is required by some compliance frameworks (PCI-DSS Requirement 3.7)
  4. Cross-account and cross-service access control via key policies

CMK support in Bedrock covers:

  • Fine-tuning training data and model artifacts
  • Knowledge Base vector stores (when using OpenSearch Serverless or Aurora)
  • Agent resources (for accounts created after January 22, 2025)
  • Invocation log buckets (S3-side encryption)

Pricing

Component Cost
CMK storage $1.00/month per key
Symmetric key API requests $0.03 per 10,000 requests
Annual automatic rotation +$1.00/month per rotated version

A typical HIPAA deployment with separate CMKs for inference logs (S3), Knowledge Base, and fine-tuning artifacts requires 3–4 CMKs. Monthly key cost: $3–$4/month.

API request volume drives the real cost. Each InvokeModel call that writes encrypted logs triggers KMS GenerateDataKey (on the S3 side). At 1 million Bedrock invocations/month with invocation logging enabled: roughly 1 million KMS requests = $3.00/month in API costs. Envelope encryption (KMS generates a data key, the data key encrypts the data, only the data key is stored encrypted) means KMS API calls are proportional to file uploads, not to bytes — so the cost scales with upload frequency, not data volume.

When CMK Is Required vs. Optional

Scenario Recommendation
Development / prototyping AWS-managed keys (free, sufficient)
Production with PII AWS-managed keys acceptable if no key revocation SLA
HIPAA with PHI CMK required — BAA requires you to demonstrate key management controls
PCI-DSS CMK required — annual rotation is a hard requirement
FedRAMP High CMK required — FIPS 140-2 Level 2 validated HSM backing

4. Bedrock Guardrails: PII Detection Costs

What Guardrails Cover

Guardrails is Bedrock’s built-in content moderation and data protection layer. Filters are applied to both inputs and outputs. For compliance use cases, the relevant filters are:

  • Sensitive information filters (PII) — detects and redacts SSN, credit card numbers, email addresses, phone numbers, names, dates of birth, addresses, and other PII categories. Available as ML-based detection or regex-based detection.
  • Content filters — toxicity, hate speech, violence
  • Denied topics — custom topic blocks
  • Word/regex filters — custom pattern matching

Pricing (Current, post-December 2024 reduction)

Filter Type Price
Content filters (text) $0.15 per 1,000 text units
Denied topics $0.15 per 1,000 text units
Sensitive information / PII (ML-based) $0.10 per 1,000 text units
Contextual grounding checks $0.10 per 1,000 text units
Word / regex filters Free
Automated Reasoning checks $0.17 per policy

One text unit = up to 1,000 characters. A typical customer support message averages 200–400 characters; a clinical note averages 1,500–3,000 characters.

Billing edge case: If Guardrails blocks an input, you pay only for the Guardrails evaluation — no inference charge. If it passes input but blocks output, you pay for both Guardrails and inference.

Regex vs. ML-Based PII Detection

Dimension Regex ML-Based
Cost Free $0.10/1K text units
Latency ~1ms ~50–150ms
Coverage Exact pattern match Contextual recognition
False positive rate Low for structured data Higher for ambiguous text
Handles paraphrased PII No Yes

Recommendation: Use regex filters for structured PII with known formats (SSN: \d{3}-\d{2}-\d{4}, credit cards, etc.) and ML-based for unstructured clinical text where names and dates appear in narrative form. Combining both layers at a healthcare chatbot processing 500K requests/month with average 2,000-character inputs:

  • ML PII filter: 500,000 requests × 2 text units × $0.10/1,000 = $100/month
  • Content filter: 500,000 × 2 × $0.15/1,000 = $150/month
  • Total Guardrails: $250/month for that workload

5. CloudTrail for Bedrock

What CloudTrail Captures

CloudTrail records management-plane API calls — CreateGuardrail, PutModelInvocationLoggingConfiguration, InvokeModel (the API call, not the content), ListFoundationModels. It does not capture prompt or response content; that requires model invocation logging.

CloudTrail data events for Bedrock must be explicitly enabled and are always charged.

Pricing

Component Cost Free Tier
Management events (first trail per region) Free Yes
Data events (Bedrock InvokeModel, etc.) $0.10 per 100,000 events None
Additional management event copies $2.00 per 100,000 events None
CloudTrail Lake ingestion $0.75/GB None
Athena queries on S3 logs $5.00/TB scanned None

Storage cost for 90-day retention: CloudTrail delivers gzip-compressed JSON to S3. Each Bedrock invocation log entry is approximately 1–2 KB uncompressed, ~200–400 bytes compressed. At 1 million invocations/month:

  • 3 months × 1M events × 300 bytes compressed = ~0.9 GB of S3 storage
  • S3 Standard storage: ~$0.02/GB = $0.02/month storage cost at this volume
  • Data event ingestion cost: 3M events/month × ($0.10/100K) = $3.00/month

For compliance, Athena is the standard tool for querying historical CloudTrail logs. A single audit query scanning 90 days of logs at ~1 GB: $5/TB × 0.001 TB = $0.005 per query. Athena charges are based on uncompressed data size — Glue table configuration with partition projection by date/region dramatically reduces per-query scan cost.

{
  "EventSelectors": [
    {
      "ReadWriteType": "All",
      "IncludeManagementEvents": true,
      "DataResources": [
        {
          "Type": "AWS::Bedrock::InferenceProfile",
          "Values": ["arn:aws:bedrock:*"]
        }
      ]
    }
  ],
  "InsightSelectors": [
    {"InsightType": "ApiCallRateInsight"},
    {"InsightType": "ApiErrorRateInsight"}
  ]
}

CloudTrail Insights adds cost ($0.35 per 100,000 analyzed events) but is justified for HIPAA — anomalous API call rates may indicate unauthorized PHI access.

6. Model Invocation Logging at Scale

Log Schema

Each invocation log record includes:

  • schemaType, schemaVersion
  • accountId, region, requestId
  • operation (InvokeModel, Converse, etc.)
  • modelId
  • input — full request payload including system prompt and user message
  • output — full response payload
  • requestMetadata — latency, input tokens, output tokens
  • identity — IAM principal ARN that made the request

For HIPAA workloads, the input and output fields may contain PHI. This means the log bucket itself becomes a PHI data store subject to the same controls as the primary data: encryption at rest with CMK, restricted access, and retention limits.

Dual-Destination Architecture

The cost-optimal and compliance-optimal architecture separates hot and cold paths:

CloudWatch Logs (hot, 30-day retention):

  • Real-time alerting on guardrail violations
  • Custom metric filters for PII detection events
  • CloudWatch Logs Insights for fast queries on recent data
  • Cost: $0.50/GB ingestion + $0.03/GB storage per month

S3 (cold, 90-day to 7-year retention):

  • Primary audit store for compliance
  • Lifecycle: Standard (0–90 days) → Glacier Instant Retrieval (90 days–2 years) → Glacier Deep Archive (2+ years)
  • Cost: $0.023/GB (Standard) → $0.004/GB (GIR) → $0.00099/GB (Deep Archive)

Scale calculation at 1M invocations/month:

Destination Volume Monthly Cost
CloudWatch ingestion ~5 GB/month (compressed) $2.50
CloudWatch storage (30d) ~5 GB × 30/31 avg $0.15
S3 Standard (first 90d) ~3 months × 5 GB $0.35
S3 Glacier (90d+, per year) ~60 GB $0.24
Total logging storage ~$3.24/month

Logging storage is not the dominant cost at this volume — KMS API calls and CloudTrail data events are larger line items.

Retention Lifecycle Policy

{
  "Rules": [
    {
      "ID": "bedrock-invocation-logs-lifecycle",
      "Status": "Enabled",
      "Filter": {"Prefix": "bedrock-logs/"},
      "Transitions": [
        {"Days": 90, "StorageClass": "GLACIER_IR"},
        {"Days": 730, "StorageClass": "DEEP_ARCHIVE"}
      ],
      "Expiration": {"Days": 2555}
    }
  ]
}

HIPAA requires a 6-year retention minimum for PHI-related records. PCI-DSS requires 12 months online, 3 years total. Set Expiration.Days to 2555 (7 years) to cover both.

7. SOC 2 / HIPAA / PCI-DSS Compliance Coverage

Certification Status (as of mid-2026)

Framework Status Notes
SOC 1 Type II Certified Covers financial reporting controls
SOC 2 Type II Certified Security, availability, confidentiality
SOC 3 Certified Public-facing SOC 2 summary
ISO 27001 Certified Information security management
ISO 27017 Certified Cloud-specific security controls
ISO 27018 Certified PII protection in cloud
ISO 27701 Certified Privacy information management
HIPAA Eligible Requires executed BAA + customer controls
PCI-DSS Covered under AWS Bedrock is in scope for AWS PCI attestation
FedRAMP Moderate High authorization in process
GDPR DPA available CISPE Code of Conduct certified

HIPAA: What “Eligible” Actually Requires

Being listed as HIPAA-eligible means AWS will sign a Business Associate Addendum (BAA) covering Bedrock. The BAA:

  • Covers AWS’s obligations as a Business Associate handling PHI
  • Does not cover your application’s behavior or the content of requests you send
  • Requires that you only process PHI within HIPAA-eligible services (Bedrock is eligible; many adjacent services are not — verify each one)

Under the Shared Responsibility Model, you remain responsible for:

  1. PHI minimization in prompts (do not send raw PHI; de-identify or use surrogate identifiers)
  2. Access controls (IAM least privilege, MFA for admin access)
  3. Audit logging (CloudTrail + invocation logging, retained per HIPAA requirements)
  4. Encryption (CMK for covered data stores)
  5. Incident response plan covering unauthorized PHI disclosure

Signing the BAA: Navigate to AWS Artifact → Agreements → Business Associate Addendum. Once signed, it applies account-wide to all HIPAA-eligible services.

PCI-DSS: Key Gaps

Bedrock is within scope of AWS’s PCI-DSS attestation for its infrastructure. For cardholder data (PANs, CVVs) in prompts:

  • Annual CMK rotation is required (PCI-DSS 3.7.4)
  • Audit logs must be retained for 12 months (3 months immediately available)
  • Key management procedures require separation of duties — distinct roles for key creation vs. application access

8. AWS Artifact for Compliance Reports

AWS Artifact provides on-demand access to AWS compliance reports at no cost. Relevant reports for Bedrock:

  • SOC 2 Type II Report — download under NDA via Artifact console
  • ISO 27001/27017/27018 Certificates — available without NDA
  • PCI AOC (Attestation of Compliance) — covers AWS infrastructure; Bedrock is in scope
  • HIPAA Whitepapers — guidance documents, not certifications

Access path: AWS Console → AWS Artifact → Reports. Reports are available in PDF and are signed by the relevant auditor. Artifact is free; the audit reports themselves carry no charge.

Important limitation: AWS Artifact reports cover AWS’s controls, not your workload. Auditors will require additional evidence of your configuration — IAM policies, CloudTrail exports, KMS key policies, network diagrams. Artifact is a starting point, not a complete compliance package.

9. EU Data Residency and GDPR

Regional Availability

Bedrock is available in EU regions including eu-west-1 (Ireland) and eu-central-1 (Frankfurt). Model availability varies by region — the full model catalog (including all Claude 3/3.5/4 variants, all Nova versions) is available in us-east-1; EU regions have a subset. As of mid-2026, eu-west-1 supports Claude 3.5 Sonnet, Claude 3 Haiku, Amazon Nova Pro/Lite/Micro, and Mistral Large, but not all Llama variants or specialized models available in us-east-1.

Cross-Region Inference Implications

AWS offers two inference routing modes:

  1. In-region inference — requests stay within the specified AWS region. Strict GDPR compliance posture. Model availability limited to that region’s catalog.
  2. Geographic (Geo) inference profiles — requests route within a defined geography (EU profile = eu-west-1 + eu-central-1 + eu-west-3). Improves throughput and availability. Data stays within the EU. Slightly better model availability than single-region.
  3. Global inference profiles — routes across any AWS region globally for lowest latency. Data may leave the EU. Not acceptable for strict GDPR workloads processing personal data.

When cross-region inference routes a request, CloudTrail and invocation logs are written only in the source region (your account’s home region), not the region where compute executes. This maintains audit trail centralization regardless of routing.

AWS’s Data Processing Addendum (DPA) covers all Bedrock models under a single agreement. The DPA includes Standard Contractual Clauses (SCCs) for EU-to-US transfers under GDPR Article 46. This means:

  • You have one processor relationship with AWS
  • Third-party model providers (Anthropic, Mistral, Cohere) are AWS sub-processors under AWS’s terms, not separate processors you must manage
  • Anthropic has an Irish entity (Anthropic Ireland, Limited) for EEA customers, but via Bedrock, AWS is the data processor — not Anthropic directly

Exception requiring separate assessment: Models from China-origin vendors (DeepSeek, MiniMax, Moonshot AI) are AWS-sold and run on AWS infrastructure, but organizations with strict data sovereignty policies should conduct a separate DPIA before processing EU personal data with these models.

Recommendation

For GDPR-sensitive workloads:

  1. Deploy to eu-west-1 or eu-central-1
  2. Enable Geo inference profile (EU) if you need throughput resilience — do not use global profiles
  3. Confirm cross-region inference is disabled or geo-constrained via SCP
  4. Store the AWS DPA in your vendor register as evidence for GDPR Article 28 obligations

10. Access Controls: IAM and SCP Patterns

Least-Privilege IAM Policy

Restrict inference to approved models only:

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Sid": "BedrockInferenceApprovedModelsOnly",
      "Effect": "Allow",
      "Action": [
        "bedrock:InvokeModel",
        "bedrock:InvokeModelWithResponseStream",
        "bedrock:Converse",
        "bedrock:ConverseStream"
      ],
      "Resource": [
        "arn:aws:bedrock:eu-west-1::foundation-model/anthropic.claude-3-5-sonnet-20241022-v2:0",
        "arn:aws:bedrock:eu-west-1::foundation-model/amazon.nova-pro-v1:0"
      ]
    },
    {
      "Sid": "DenyDirectInvokeBypassingGuardrails",
      "Effect": "Deny",
      "Action": "bedrock:InvokeModel",
      "Resource": "*",
      "Condition": {
        "Null": {"bedrock:GuardrailIdentifier": "true"}
      }
    }
  ]
}

The second statement enforces that all inference must go through an approved Guardrail — any call without a GuardrailIdentifier context key is denied. This prevents developers from invoking models directly and bypassing PII filters.

SCP Patterns for Compliance Enforcement

Block non-EU inference for GDPR accounts:

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Sid": "DenyBedrockOutsideEU",
      "Effect": "Deny",
      "Action": "bedrock:*",
      "Resource": "*",
      "Condition": {
        "StringNotEquals": {
          "aws:RequestedRegion": ["eu-west-1", "eu-central-1", "eu-west-3"]
        }
      }
    }
  ]
}

Block unapproved model families:

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Sid": "DenyNonApprovedModels",
      "Effect": "Deny",
      "Action": ["bedrock:InvokeModel", "bedrock:InvokeModelWithResponseStream"],
      "NotResource": [
        "arn:aws:bedrock:*::foundation-model/anthropic.*",
        "arn:aws:bedrock:*::foundation-model/amazon.*"
      ]
    }
  ]
}

VPC endpoint policy restricting to specific roles:

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Deny",
      "Principal": "*",
      "Action": "bedrock:InvokeModel",
      "Resource": "*",
      "Condition": {
        "StringNotEquals": {
          "aws:PrincipalArn": [
            "arn:aws:iam::<account-id>:role/bedrock-inference-role",
            "arn:aws:iam::<account-id>:role/bedrock-agent-role"
          ]
        }
      }
    }
  ]
}

Three-Role Logging Model

For log access separation required by some compliance auditors:

Role Permissions Access To
BasicCompletionLogReviewer logs:GetLogEvents Redacted log stream
SensitiveDataLogReviewer logs:GetLogEvents + logs:Unmask Full content including PII
CompletionLogAdmin logs:* but explicit Deny on kms:Decrypt Log structure, not decrypted content

11. Third-Party Model Compliance

What Third-Party Models Inherit

When a third-party model (Cohere, Mistral, Llama, Stability AI) is accessed through Bedrock, the compliance coverage comes from AWS’s infrastructure and DPA, not the model provider’s own certifications:

  • AWS’s SOC 2 Type II, ISO 27001/27017/27018, HIPAA BAA, PCI AOC all cover the infrastructure serving these models
  • Model providers are AWS sub-processors — they do not receive your data; they provided the model weights to AWS, which AWS operates in isolated deployment accounts
  • You do not need separate DPAs, BAAs, or compliance assessments for Cohere, Mistral, or Meta Llama when accessing them through Bedrock

What Third-Party Models Do Not Inherit

  • The model provider’s own compliance certifications (Cohere’s SOC 2, Mistral’s GDPR posture) are irrelevant when using Bedrock — AWS is the processor
  • However, if a model provider’s weights have embedded biases or training data issues that produce PHI-like outputs, that is an application-level concern, not a platform compliance issue
  • Bedrock Marketplace models (100+ specialized models) vary — evaluate whether they are AWS-sold (infrastructure covered) or sold directly through Marketplace under separate terms

China-origin model exception: DeepSeek, MiniMax, and Moonshot AI models available in Bedrock Marketplace are AWS-sold and run on AWS infrastructure. The technical data path is identical to Anthropic or Meta. However, organizations with policies restricting use of China-origin AI systems (e.g., DOD contractors, ITAR-adjacent environments) should evaluate organizational policy — this is not a GDPR or HIPAA gap but a geopolitical/policy consideration.

FedRAMP Gap

Bedrock currently holds FedRAMP Moderate authorization. Third-party models available on Bedrock are within scope of that authorization for the infrastructure layer. However, FedRAMP Moderate only covers federal civilian agencies and contractors at that impact level — FedRAMP High is not yet granted for Bedrock, which excludes it from higher-sensitivity federal workloads regardless of model choice.

12. Total Cost of HIPAA-Compliant Bedrock: Reference Calculation

The following models a HIPAA-eligible Bedrock deployment for a mid-size healthcare organization running a clinical documentation assistant: 500,000 model invocations/month, average request ~2,000 characters, 2-AZ deployment in us-east-1, PHI in prompts, 7-year log retention requirement.

Infrastructure Cost Stack

Component Configuration Monthly Cost
VPC Interface Endpoints 2 AZ × $0.01/hr × 730hr $14.60
VPC Endpoint data processing ~50 GB/month × $0.01/GB $0.50
KMS CMK storage 4 keys (logs, KB, finetuning, S3) $4.00
KMS API calls 500K invocations → ~500K KMS calls × $0.03/10K $1.50
Guardrails — PII ML filter 500K req × 2 text units × $0.10/1K $100.00
Guardrails — content filter 500K req × 2 text units × $0.15/1K $150.00
CloudTrail data events 500K events × $0.10/100K $0.50
CloudTrail Insights 500K events × $0.35/100K $1.75
Model invocation logging — CWL ingestion ~2.5 GB × $0.50/GB $1.25
Model invocation logging — S3 Standard (3mo) ~7.5 GB × $0.023/GB $0.17
Model invocation logging — Glacier Instant Retrieval (after 90d) ~90 GB/yr × $0.004/GB $0.36
S3 logging bucket — Glacier Deep Archive (yr 2–7) ~540 GB × $0.00099/GB $0.53
Athena audit queries ~10 queries × 1 GB scanned × $5/TB $0.05
Total compliance infrastructure ~$274.71/month

Note: This excludes the primary Bedrock inference cost (model tokens) and any Knowledge Base or agent infrastructure. At $0.003/1K output tokens (Claude 3.5 Sonnet pricing), 500K invocations at 500 tokens average output = $750/month in inference alone.

Standard Bedrock (no compliance stack):

  • Inference: ~$750/month
  • Default encryption: $0
  • No VPC endpoint: $0
  • No Guardrails: $0
  • Free CloudTrail management events: $0
  • Total: ~$750/month

HIPAA-compliant Bedrock (same workload):

  • Inference: ~$750/month
  • Compliance infrastructure: ~$275/month
  • Total: ~$1,025/month

Compliance overhead: ~37% premium on total cost at this scale.

The Guardrails PII and content filters dominate the security overhead ($250 of the $275). At higher request volumes, the overhead percentage decreases because inference costs scale faster than per-request Guardrails costs. At 5 million invocations/month, compliance overhead drops to roughly 20–25% of total spend.

Cost Optimization Without Compromising Compliance

  1. Use regex filters for structured PII — SSNs, credit cards, phone numbers via free regex patterns rather than $0.10/1K ML detection. Reserve ML detection for clinical note text where names/dates are narrative.
  2. Route logs to S3 directly for long-term compliance retention and query via Athena — avoid accumulating in CloudWatch beyond 30 days at $0.03/GB/month.
  3. Single CMK with multiple aliases — AWS KMS supports aliases; one CMK can cover multiple data types in the same account, reducing key storage cost from $4 to $1/month.
  4. Batch invocation logging to S3 — log directly to S3 rather than through CloudWatch Logs to save $0.50/GB ingestion cost on long-term compliance data.

Key Findings

  1. The training-data guarantee is genuine and contractual — prompts and responses never leave Bedrock for model training. This is in the AWS service terms and BAA, not just marketing copy.

  2. Model invocation logging is off by default — turning it on is required for HIPAA audit compliance but adds cost and creates a PHI-containing data store requiring its own controls. Treat the log bucket as carefully as the application database.

  3. PrivateLink is necessary, not optional, for regulated data — the cost is low ($14.60/month for 2-AZ) and it simplifies the security review by eliminating internet egress from the threat model.

  4. Guardrails PII filters are the dominant compliance cost at moderate scale ($250/month for 500K requests). The 80–85% price reduction in December 2024 made these viable; they were prohibitive before.

  5. Third-party models inherit Bedrock’s compliance coverage — Cohere, Mistral, Llama via Bedrock do not require separate BAAs or compliance assessments for HIPAA or PCI. The infrastructure compliance boundary is at Bedrock, not the model provider.

  6. EU data residency requires explicit configuration — Bedrock defaults to the API endpoint’s region, but cross-region inference profiles can silently route requests to non-EU regions if a global profile is selected. SCP enforcement on aws:RequestedRegion is the only reliable control.

  7. Compliance overhead is ~37% at 500K invocations/month — this is the realistic incremental cost of HIPAA-compliant vs. standard deployment. CFOs budgeting Bedrock for healthcare should assume 30–40% premium on the model inference cost for the security stack.

Sources: AWS Bedrock FAQs, AWS Security Blog (least-privilege patterns), AWS Bedrock documentation (model invocation logging, regional availability, guardrails pricing), accountablehq.com (HIPAA BAA requirements), cloudburn.io (CloudTrail pricing, KMS pricing), xorabyte.com (GDPR/SOC 2 per-model guide), AWS machine learning blog (EU cross-region inference), medium/@odere.pub (data residency per model).