🛡️ AWS Bedrock Provisioned Throughput should use an Active model🟢

• Contextual name: 🛡️ Provisioned Throughput should use an Active model🟢
• ID: /ce/ca/aws/bedrock/provisioned-model-support
• Tags:
  • 🟢 Policy with categories
  • 🟢 Policy with type
  • 🟢 Production policy
• Policy Type: BEST_PRACTICE
• Policy Categories: RELIABILITY

Stats

not available

Logic

• 🧠 prod.logic.yaml🟢
  • 📗 AWS Bedrock Provisioned Model Throughput
  • 🔌 AWS Bedrock Provisioned Model Throughput - object.extracts.yaml
  • 🔌 AWS Bedrock Foundation Model - object.extracts.yaml
  • 🧪 test-data.json

Description

Open File

Description

Identify Amazon Bedrock Provisioned Throughputs in the InService or Updating state whose current foundation model is in the LEGACY lifecycle state. This preventive requirement is to use an Active model and prepare migration before retirement.

Rationale

A Legacy foundation model is scheduled for retirement. Moving inference workloads to an Active model before the regional EOL date reduces the risk of requests failing when the old model becomes unavailable. AWS does not migrate callers automatically.

Impact

Migration can change response quality, latency, model behavior, capacity requirements, and cost. Provisioned Throughput by Model Units associated with a base model cannot have its model changed in place; provision a replacement as needed, validate it, and update inference callers. Review existing commitments before purchasing or retiring capacity.

Audit

This policy marks an AWS Bedrock Provisioned Model Throughput as INCOMPLIANT if its Status is InService or Updating and its current Model resolves to an AWS Bedrock Foundation Model whose Model Lifecycle: Status is LEGACY. It is COMPLIANT when that lifecycle status is ACTIVE. The related Model ARN must exactly match the throughput's current Model ARN, including the AWS Region and any context-length suffix. Legacy means deprecated and scheduled for retirement; it does not establish EOL, paid extended access, or actual request traffic. Existing Legacy endpoints may still be valid for inference; the finding calls for migration planning rather than declaring an outage or an invalid deployment.

... see more

Remediation

Open File

Remediation

Migrate workloads that use a Legacy foundation model to an Active model before the announced retirement date. Keep the existing capacity until the replacement is ready and applications have switched to it.

1. Confirm the current model

Use the Provisioned Throughput ARN and AWS Region from the Cloudaware finding. Replace PROVISIONED_MODEL_ARN and REGION in this command:

aws bedrock get-provisioned-model-throughput --provisioned-model-id PROVISIONED_MODEL_ARN --region REGION

Check the returned modelArn, status, and commitment expiration time. Identify the applications and integrations that use this Provisioned Throughput.

Use the returned modelArn as CURRENT_FOUNDATION_MODEL_ARN to check the model in the same Region:

aws bedrock get-foundation-model --model-identifier CURRENT_FOUNDATION_MODEL_ARN --region REGION

Confirm its lifecycle status and review the retirement date in the AWS lifecycle documentation or the model card. During an update, desiredModelArn identifies the requested model; the old model can continue serving until deployment finishes.

... see more

policy.yaml

Open File

Linked Framework Sections

Section	Sub Sections	Internal Rules	Policies	Flags	Compliance
💼 Cloudaware Framework → 💼 Infrastructure Modernization			39		no data