AWS Well-Architected Generative AI Lens

Reference: AWS GenAI Lens (updated Nov 2025)

When to Apply

• Designing GenAI architectures on AWS (Bedrock, SageMaker AI)
• Implementing RAG pipelines with vector stores and knowledge bases
• Selecting foundation models and deciding between prompting, RAG, and fine-tuning
• Configuring guardrails for content safety, PII protection, and hallucination detection
• Optimizing GenAI workload costs (model selection, caching, batching)
• Securing AI workloads (prompt injection defense, data protection, access control)
• Applying responsible AI principles to production FM workloads

GenAI Design Principles

1. Design for controlled autonomy — bound agent actions with explicit guardrails and stopping conditions
2. Implement comprehensive observability — monitor prompts, responses, latency, cost, and quality metrics
3. Optimize resource efficiency — right-size models; use caching and batching to reduce cost
4. Establish distributed resilience — design for FM endpoint failures, throttling, and degraded responses
5. Standardize resource management — centralize model access, prompt catalogs, and configuration
6. Secure interaction boundaries — validate inputs, filter outputs, enforce least privilege on FM endpoints

Lifecycle Phases

Model Selection and Customization Strategy

Decision Tree

Start with prompt engineering (lowest cost, fastest iteration)
  ↓ Not meeting quality bar?
Add RAG for knowledge-grounded tasks
  ↓ Still not meeting quality bar?
Fine-tune when behavior/style is the bottleneck
  ↓ Need maximum control?
Custom training via SageMaker HyperPod

• MUST start with prompt engineering and evaluate before investing in RAG or fine-tuning
• MUST benchmark multiple models on representative tasks before selecting
• SHOULD use the smallest model that meets quality requirements — model right-sizing is the single biggest cost lever

Model Selection Criteria

Prompt Engineering

Rules

• MUST implement a centralized prompt catalog with version control — treat prompts as code
• MUST separate system prompts from user input to prevent instruction override
• MUST use few-shot examples for tasks requiring consistent format or style
• SHOULD implement prompt templates with variable substitution for maintainability
• SHOULD measure and track prompt performance metrics (quality, latency, cost)

Prompt Injection Defense

• MUST use Bedrock Guardrails Prompt Attack filter on all user-facing endpoints
• MUST sanitize and validate all user inputs before sending to the model
• MUST assume injection CAN succeed — design defense-in-depth (input filtering + output validation + action authorization)
• SHOULD separate system instructions from user content using clear delimiters
• MUST NOT trust model output for security-critical decisions without validation

RAG (Retrieval-Augmented Generation)

RAG augments FM responses with retrieved knowledge, reducing hallucination and keeping responses grounded.

Amazon Bedrock Knowledge Bases

Automates the full RAG pipeline: ingestion → chunking → embedding → vector storage → retrieval → prompt augmentation.

Vector Store Options

Chunking Strategies

RAG Quality Rules

• MUST implement contextual grounding checks to detect hallucination in RAG responses
• SHOULD use hybrid search (vector + keyword) for better retrieval precision
• SHOULD evaluate retrieval quality separately from generation quality
• SHOULD implement metadata filtering to narrow retrieval scope

Fine-Tuning

SHOULD fine-tune only when prompt engineering + RAG cannot achieve the required quality for behavior or style.

Approaches

• MUST establish baseline metrics with prompting + RAG before fine-tuning
• MUST maintain a high-quality evaluation dataset throughout the fine-tuning process
• SHOULD use LoRA as the default fine-tuning approach for cost efficiency

Responsible AI

Eight Dimensions

• MUST implement safety guardrails on all production FM endpoints
• MUST document model limitations and known failure modes
• SHOULD establish AI governance processes before production deployment

Amazon Bedrock Guardrails

Six safeguard policies applied on both inbound prompts and outbound responses:

• MUST configure content filters on all user-facing FM endpoints
• MUST enable PII detection for workloads handling personal data
• SHOULD enable contextual grounding checks for all RAG workloads
• The ApplyGuardrail API works with ANY model, including self-hosted or third-party

Cost Optimization

Pricing Models

Cost Reduction Strategies

• MUST right-size the model — use the smallest model meeting quality requirements
• SHOULD implement prompt caching for repeated prefixes (system prompts, few-shot examples)
• SHOULD use batch processing for non-real-time workloads (up to 50% cost savings)
• SHOULD implement intelligent routing by query complexity (simple queries → smaller model)
• SHOULD set agent stopping conditions to prevent runaway loops
• SHOULD optimize prompt length — shorter prompts with same quality reduce per-request cost

Security

Rules

• MUST enforce least privilege IAM policies for all FM endpoint access
• MUST use AWS PrivateLink for private VPC-to-Bedrock connections in production
• MUST use customer-managed KMS keys for encryption of model inputs/outputs and fine-tuning data
• MUST enable CloudTrail logging for all Bedrock API calls
• SHOULD implement defense-in-depth: IAM → VPC → WAF → Guardrails → input validation → output encoding
• SHOULD use Bedrock AgentCore with Cedar policy language to enforce boundaries on agent tool calls

Key guarantee: Amazon Bedrock does not allow model providers to learn from customer data or prompts.

Checklist

When designing or reviewing a GenAI workload on AWS:

• Business problem is clearly defined; GenAI is confirmed as the right approach
• Model selection is based on benchmarks, not assumptions; smallest effective model chosen
• Prompt engineering is exhausted before adding RAG; RAG before fine-tuning
• Centralized prompt catalog exists with version control
• Prompt injection defenses are implemented (Guardrails + input validation + defense-in-depth)
• RAG pipeline uses appropriate chunking and includes contextual grounding checks
• Bedrock Guardrails are configured: content filters, PII detection, and denied topics at minimum
• Cost optimization applied: model right-sizing, caching, batching where applicable
• IAM least privilege, PrivateLink, KMS encryption, and CloudTrail are configured
• Responsible AI dimensions are addressed: safety, fairness, transparency, governance
• Monitoring covers: latency, cost per request, quality metrics, guardrail triggers, error rates

Key References