Operational intelligence for Amazon Bedrock

Root cause analysis for Amazon Bedrock production failures.

CloudWatch tells you that Bedrock throttled. BedrockOps ranks why: which caller burned the TPM quota, which retry loop amplified the 429s, and which Knowledge Base change landed four hours earlier.

Trial is $0 for 7 days through AWS Marketplace. Connect with a read-only cross-account IAM role.

Ranked cause across runtime, KB and deploys

Read-only IAM role, no in-path proxy

Customer data stays in Europe today

Trial and billing through AWS Marketplace

The product

What BedrockOps does that CloudWatch generative AI observability does not

CloudWatch now ships native Bedrock metrics, including EstimatedTPMQuotaUsage and TimeToFirstToken, plus tracing and token usage. BedrockOps sits above that layer. It attributes those metrics to a caller, correlates them with Knowledge Base and deployment events, and ranks the cause.

PILLAR 01

Cross-pillar root-cause analysis

Correlates runtime failures, Knowledge Base events, prompt changes, model changes and deployments into one ranked cause list with evidence. It answers why the incident happened, not just what the metric did.

  • Ranked probable causes with linked evidence
  • Unified incident timeline across signals
  • Cross-signal event linking
  • Full-context incident workspace
Cross-signal Bedrock incident review

PILLAR 02

Knowledge Base operations

Release management for RAG, not monitoring. Compare a candidate Knowledge Base against the live one, promote it with an audit log, and roll back when retrieval quality drops. Ingestion and retrieval intelligence sits underneath.

  • Ingestion failure intelligence
  • Retrieval configuration validation
  • Retrieval quality tracking over time
  • Tenant isolation checks
  • Candidate versus live KB comparison
  • Audit-logged promotion and rollback
Knowledge Base promotion and rollback workflows

PILLAR 03

Runtime intelligence

The layer above CloudWatch metrics. Quota burn attributed to a caller and a workload, throttling classified by type, and retry storms named before they take the workload down.

  • Quota burn by caller and workload
  • Throttling classification: 429 vs 503, TPM vs RPM pressure
  • Retry amplification detection
  • Connection pool saturation
  • Throttle root-cause classification with per-event runbook guidance
  • Runtime readiness checks
  • Agent tool-use correctness scoring
Bedrock TPM quota burn and 429 throttling analysis

Candidate versus live, before you promote a Knowledge Base

AWS gives you a Knowledge Base and a sync API. It does not give you a release process. BedrockOps runs the candidate and the live Knowledge Base against the same probe set, records who promoted what and when, and keeps the rollback path open.

Knowledge Base promotion and candidate comparison

Use cases

Which Amazon Bedrock production failure are you debugging?

Every answer opens the same investigation surface. Pick the one that matches the error in front of you right now.

Why is Bedrock returning 429 ThrottlingException?

Requests are failing and nobody can tell whether it is TPM pressure, RPM pressure, a retry storm, or AWS-side capacity.

  • Quota burn attributed to a caller and workload
  • 429 versus 503 classification, TPM versus RPM pressure
  • Retry amplification and connection pool saturation
  • The next step for that failure class
Bedrock quota and throttling investigations

Why did my Bedrock Knowledge Base sync fail?

Ingestion jobs fail, answers get worse, or reranking and metadata filters behave differently than they did last week.

  • Failed documents and repeated ingestion failure patterns
  • Retrieval configuration validation
  • Retrieval quality tracked over time
  • Tenant isolation checks across Knowledge Bases
Knowledge Base sync failures and retrieval degradation

Is this Knowledge Base change safe to promote?

A chunking, embedding or rerank change looks fine in a notebook, and nobody wants to promote it to production on that evidence.

  • Candidate versus live comparison on one probe set
  • Audit-logged promotion with an owner and a timestamp
  • Rollback to the previous Knowledge Base
  • Evidence attached to the promotion record
Knowledge Base promotion and candidate comparison

What actually caused this Bedrock incident?

The incident spans runtime throttling, retrieval quality and a deployment, and the review needs one timeline instead of four consoles.

  • One unified incident timeline
  • Ranked probable causes with evidence
  • Linked events across runtime, Knowledge Base and deploys
  • A review artifact once the incident closes
Cross-signal Bedrock incident review

Trust model

Read-only IAM, no in-path proxy, and data that stays in Europe

BedrockOps is delivered entirely on AWS. Onboarding is a read-only cross-account IAM role. Live traffic is never rerouted, so the security review is about read access, not about a new dependency in the request path.

Read the AWS trust and onboarding model

Delivered entirely on AWS

The whole product runs on AWS-native infrastructure.

Read-only IAM by default

Cross-account role onboarding with no write permissions.

No in-path proxy

Live Bedrock traffic is never routed through BedrockOps.

Data stays in Europe today

Broader regional coverage comes in later versions.

Pricing

BedrockOps pricing, billed through AWS Marketplace

Start on a 7-day trial. Move to Production when the team is ready. Billing scales with AWS accounts and Knowledge Bases, not with telemetry volume.

Trial

$0 / 7 days

Connect one account and see the product against live Bedrock signals.

  • 1 AWS account
  • 3 Knowledge Bases monitored
  • 7-day retention
  • 3 alert rules
  • 1 email destination
  • $0 through AWS Marketplace

Enterprise

Custom

Larger footprints, longer retention, stronger security and commercial requirements.

  • Unlimited AWS accounts
  • Unlimited Knowledge Bases
  • 90 days hot retention
  • Unlimited alert rules and destinations
  • Unlimited digest schedules
  • StackSet onboarding and SLA
Contact us

Billing controls. Customer-set monthly spend cap, an in-app spend projection at 50%, an email warning to admins at 80%, and protected mode at 100%.

AWS Marketplace

How do I buy BedrockOps through AWS Marketplace?

AWS Marketplace is the only payment path. There is no direct web checkout, so spend runs against the existing AWS bill.

Start the trial

Start the 7-day trial from the BedrockOps listing in AWS Marketplace.

Connect AWS

Create a read-only cross-account IAM role. No proxy, no traffic reroute.

Ingest signals

Bedrock runtime, Knowledge Base, quota and deployment signals start arriving.

Continue on paid

Move to Production in AWS Marketplace when the trial ends.

FAQ

Amazon Bedrock questions engineers ask before connecting an account

How do I find which service is burning my Bedrock TPM quota?
BedrockOps attributes tokens-per-minute consumption to the caller identity and workload behind each InvokeModel call, then ranks callers by burn over the selected window. CloudWatch reports EstimatedTPMQuotaUsage for the account and model; BedrockOps reports which application, role or workload produced it.
What is the difference between 429 and 503 errors in Amazon Bedrock?
A 429 ThrottlingException means your request exceeded a quota you own, usually tokens or requests per minute for that model and region. A 503 ServiceUnavailable means the service side could not serve the request. The remediation differs: 429 means fix client concurrency, spread load with cross-region inference, or raise the quota; 503 means back off, retry with jitter, and fail over.
Why did my Bedrock Knowledge Base sync fail?
Ingestion jobs usually fail on a subset of documents rather than the whole data source: unsupported formats, oversized files, encoding problems, permission errors on the S3 prefix, or embedding calls that were themselves throttled. BedrockOps groups failed documents by failure reason and links the ingestion job to the retrieval quality change it caused.
Is BedrockOps a Bedrock dashboard?
No. BedrockOps is built for explanation, not for raw dashboarding. CloudWatch generative AI observability is the right place for Bedrock metrics, traces and token usage. BedrockOps consumes that layer and adds attribution, cross-signal correlation, ranked cause and Knowledge Base release control.
What is a Bedrock retry storm, and how do I detect retry amplification?
A retry storm happens when a client SDK retries throttled requests aggressively, so each throttled call generates several more, which consume more quota and produce more throttling. The signature is a retry-to-request ratio well above 1 concentrated in one caller while the underlying request rate is flat. BedrockOps measures that ratio per caller and flags amplification.
Can I compare a candidate Knowledge Base to the live one before promoting it?
Yes. BedrockOps runs the candidate and the live Knowledge Base against the same probe set and reports retrieval-quality scores, zero-result rate and tenant isolation results side by side. Promotion is recorded with an owner, a timestamp and the comparison evidence, and the previous Knowledge Base stays available for rollback.
Does BedrockOps require an in-path proxy?
No. There is no in-path proxy and no traffic reroute. BedrockOps reads signals from your account and never sits in the request path of a production Bedrock call.
What AWS permissions does BedrockOps need?
A cross-account IAM role with read-only permissions, assumed by BedrockOps with an external ID. It reads Bedrock runtime and Knowledge Base signals, quota and throttling data, and deployment events. There are no write permissions and no changes to your Bedrock configuration.
Where is customer data stored?
Customer operational data stays in Europe today, and the product is delivered entirely on AWS. Broader regional coverage will come in later versions.
How much does BedrockOps cost, and how do I buy it?
A 7-day trial is $0. Production is $199 per month, or $159 per month billed annually, and includes 3 AWS accounts and 10 Knowledge Bases. Overage is $49 per extra account and $10 per extra Knowledge Base. Enterprise pricing is custom — contact us. Everything starts and bills through AWS Marketplace, with a customer-set monthly spend cap.

Read the full BedrockOps FAQ

Run BedrockOps against your live Bedrock signals

Start the trial in AWS Marketplace, connect one AWS account with a read-only role, and get ranked causes against real runtime and Knowledge Base data.