Review Bedrock data, identity and operational controls
Collect concrete evidence for permissions, processing locations, storage and incident ownership.
Identify the exact system under review
Record account ownership, source Region, endpoint, API, model or inference profile, data sources and connected tools. Include logs, response storage, caches and backups in the data-flow map. A diagram showing only the model call misses data retained elsewhere.
Review these controls with their owners
| Control | Evidence | Test |
|---|---|---|
| Workload identity | Role and resource-scoped policy | Unauthorized caller is denied |
| Data access | Document and record permission rules | Two roles see different permitted data |
| Processing location | Model card and profile destinations | Configuration uses the approved geography |
| Retention | Response, log and cache settings | Stored material follows the chosen lifecycle |
| Business actions | Approval, validation and duplicate handling | An unapproved or repeated write is rejected or handled safely |
| Operations | Incident owner and recovery runbook | A failed dependency produces a controlled result |
Check storage separately from invocation
Responses defaults to storing conversation state; choose store: false when state retention is unwanted. This does not replace a review of application logs or separately configured invocation logging. Invocation logging can capture prompts and outputs and is disabled by default. Give log access and retention their own controls.
Cross-Region inference can process outside the source Region. Geographic scope is a technical routing boundary, not a legal conclusion. Have the responsible reviewer assess applicable contractual and regulatory requirements against the full data flow.
Produce a decision register
For each finding record the owner, evidence, required change and release consequence. Verify fixes with negative tests, not only policy screenshots. Keep unresolved findings visible and distinguish engineering acceptance from any legal review. This checklist helps organize evidence; it does not certify compliance.
Official references
Documentation checked: 17 October 2026. The instructions are reference guidance; no cloud API was called for this article.