Blab AI
AWS Bedrock Adds Cross-Region Inference to Meet EU Data-Protection Needs
AWS Bedrock has just unlocked a new capability—cross‑Region inference (CRIS)—that lets customers route model‑inference requests across multiple AWS regions while keeping data safely inside the AWS network. The move is a direct response to the growing demand for the platform’s extensive model library from enterprises that must also satisfy the General Data Protection Regulation (GDPR) and other regional data‑protection rules.
CRIS changes how a request is identified. Instead of supplying a simple model ID, developers now provide an inference profile ID. The profile tells Bedrock which set of regions the request may travel to. Two profile families exist: global profiles, which permit forwarding to any commercial AWS region worldwide, and geographic profiles, which confine forwarding to a predefined set of regions. Geographic profiles are named after the model and the geography they cover.
For customers in Europe, AWS has rolled out EU‑specific inference profiles. When a request originates from an EU region, the profile limits routing to other EU regions only, ensuring that data never leaves the EU when the EU profile is used. Requests that start outside the EU can still be routed to EU regions, but the source region remains unchanged. This restriction helps customers meet residency requirements without sacrificing access to Bedrock’s full model catalog.
Security is baked into CRIS. All traffic between source and destination regions travels over AWS’s private backbone and is encrypted in transit. Customers must explicitly enable CRIS in code by supplying the inference‑profile ID. IAM controls let customers grant or deny permission to invoke a specific profile, enforcing least‑privilege access. Logging is handled by CloudTrail, which records metadata for every Bedrock API call, including source and destination regions. Bedrock also offers optional model‑invocation logging that captures full request and response payloads and can be sent to CloudWatch Logs or S3. Importantly, all logs are stored in the source region, keeping audit data local.
Compliance with GDPR is supported through several mechanisms. Bedrock is covered by the CISPE Data Protection Code of Conduct, a pan‑European code approved by the European Data Protection Board, confirming that AWS services can be used in a GDPR‑compliant manner. Customers can also transfer data from the European Economic Area to non‑EEA destinations that lack an adequacy decision, such as the United States, while still using CRIS. The combination of geographic profiles, encrypted traffic, IAM controls, and audit logs gives customers a clear trail of where data is processed.
Using CRIS is straightforward. The Bedrock console displays available inference profiles for a chosen source region. Developers can retrieve a profile ID via the AWS SDK (for example, Boto3) or by consulting Bedrock documentation. In code, the profile ID replaces the model ID in the InvokeModel or Converse API calls.
Overall, CRIS expands Bedrock’s capacity and resilience. By routing requests to the region with the most available model capacity, customers can avoid peak‑hour throttling and reduce latency. At the same time, the feature respects geographic boundaries and audit requirements that are critical for many European enterprises.
AWS says it will continue to add new compliance programs and tooling to help customers evaluate risk and create data‑privacy impact assessments. For questions about AI workloads and cross‑Region inference, the company recommends contacting an AWS account team.
CRIS changes how a request is identified. Instead of supplying a simple model ID, developers now provide an inference profile ID. The profile tells Bedrock which set of regions the request may travel to. Two profile families exist: global profiles, which permit forwarding to any commercial AWS region worldwide, and geographic profiles, which confine forwarding to a predefined set of regions. Geographic profiles are named after the model and the geography they cover.
For customers in Europe, AWS has rolled out EU‑specific inference profiles. When a request originates from an EU region, the profile limits routing to other EU regions only, ensuring that data never leaves the EU when the EU profile is used. Requests that start outside the EU can still be routed to EU regions, but the source region remains unchanged. This restriction helps customers meet residency requirements without sacrificing access to Bedrock’s full model catalog.
Security is baked into CRIS. All traffic between source and destination regions travels over AWS’s private backbone and is encrypted in transit. Customers must explicitly enable CRIS in code by supplying the inference‑profile ID. IAM controls let customers grant or deny permission to invoke a specific profile, enforcing least‑privilege access. Logging is handled by CloudTrail, which records metadata for every Bedrock API call, including source and destination regions. Bedrock also offers optional model‑invocation logging that captures full request and response payloads and can be sent to CloudWatch Logs or S3. Importantly, all logs are stored in the source region, keeping audit data local.
Compliance with GDPR is supported through several mechanisms. Bedrock is covered by the CISPE Data Protection Code of Conduct, a pan‑European code approved by the European Data Protection Board, confirming that AWS services can be used in a GDPR‑compliant manner. Customers can also transfer data from the European Economic Area to non‑EEA destinations that lack an adequacy decision, such as the United States, while still using CRIS. The combination of geographic profiles, encrypted traffic, IAM controls, and audit logs gives customers a clear trail of where data is processed.
Using CRIS is straightforward. The Bedrock console displays available inference profiles for a chosen source region. Developers can retrieve a profile ID via the AWS SDK (for example, Boto3) or by consulting Bedrock documentation. In code, the profile ID replaces the model ID in the InvokeModel or Converse API calls.
Overall, CRIS expands Bedrock’s capacity and resilience. By routing requests to the region with the most available model capacity, customers can avoid peak‑hour throttling and reduce latency. At the same time, the feature respects geographic boundaries and audit requirements that are critical for many European enterprises.
AWS says it will continue to add new compliance programs and tooling to help customers evaluate risk and create data‑privacy impact assessments. For questions about AI workloads and cross‑Region inference, the company recommends contacting an AWS account team.
