Trust model
Read-only IAM, no in-path proxy, and data that stays in Europe.
BedrockOps is delivered entirely on AWS. Onboarding is a read-only cross-account IAM role, live traffic is never rerouted, and procurement stays on AWS Marketplace. The security review is about read access, not about a new dependency in the request path.
Trial is $0 for 7 days through AWS Marketplace. Connect with a read-only cross-account IAM role.
The operating boundary
Four commitments, stated plainly
Delivered entirely on AWS
The whole product runs on AWS-native infrastructure.
Read-only IAM by default
Cross-account role onboarding with no write permissions.
No in-path proxy
Live Bedrock traffic is never routed through BedrockOps.
Data stays in Europe today
Broader regional coverage comes in later versions.
What the role can do
Read access, scoped and external-ID protected
What this removes
Less security friction, less procurement friction
Review a read-only connection
Instead of evaluating a new traffic path, review a familiar cross-account IAM role with an external ID and no write permissions.
Connect without changing routing
Onboard BedrockOps without touching request routing, SDK configuration or the production call path.
Stay on the AWS billing path
Spend runs against the existing AWS bill, with no second checkout to approve.
Data handling today
Europe is the active data region
Customer operational data stays in Europe today. The regional scope is stated explicitly so AWS teams can evaluate the operating boundary before connecting production data.
What we do not ask for
No proxy, no traffic reroute, no second checkout
- No in-path runtime proxy
- No direct web checkout
- No write permissions on your AWS account
- No vague data-boundary story
Start BedrockOps on an AWS-native path
Start the trial in AWS Marketplace, connect AWS with a read-only role, and run BedrockOps against real Bedrock signals without changing live traffic flow.