Study guide
2.1 Managed RAG Architecture with Bedrock Knowledge Bases
AWS Certified Generative AI Developer - Professional AIP-C01
Track your progress as you read
Finished sections get a check mark.
1 Chapter 1: Exam Overview & Foundation Model Fundamentals
1.1 AIP-C01 Exam Structure, Logistics & Passing Strategy 1.2 AIP-C01 Scoring & Professional Decision Strategy 1.3 Foundation Model Landscape & Model Selection on Amazon Bedrock 1.4 Model Abstraction, Controlled Switching & Resilience 1.5 Customization Spectrum: Prompting vs RAG vs Fine-Tuning vs Continued Pre-training 1.6 Custom Model Deployment & Lifecycle Management
2 Chapter 2: Bedrock Knowledge Bases & RAG Architectures
2.1 Managed RAG Architecture with Bedrock Knowledge Bases 2.2 Knowledge Source Integration, Synchronization & Freshness 2.3 Data Ingestion, Parsing & Chunking Strategies 2.4 Embedding Models & Vector Representations 2.5 Vector Index Scale, Migration & Retrieval Evaluation 2.6 Vector Database Selection: OpenSearch Serverless vs Aurora pgvector vs Managed Stores 2.7 Vector Store Security, Multi-Tenancy & Connectivity
3 Chapter 3: Advanced Vector Search, Indexing & Data Compliance
3.1 Hybrid Search, Metadata Filtering & Semantic Reranking 3.2 Metadata Filtering, Reranking & Query Transformation 3.3 Fine-Tuning & Continued Pre-Training Data Pipeline Engineering 3.4 Data Validation, Multimodal Processing & Model Formatting 3.5 Data Privacy, Data Residency & Compliance Governance 3.6 Privacy Preservation, Source Lineage & Audit Evidence
4 Chapter 4: Prompt Engineering & Bedrock Runtime APIs
4.1 Advanced Prompt Engineering Techniques & Inference Parameters 4.2 Inference Parameters, Prompt Governance & Regression 4.3 Converse API vs InvokeModel API & Message Formatting 4.4 Tool Calling, FM API Resilience & Model Routing 4.5 Streaming Architectures & Asynchronous Event Processing 4.6 Resilient Streaming, Deployment & Asynchronous Processing
5 Chapter 5: Amazon Bedrock Agents & Tool Integration
5.1 Agentic Architecture, ReAct Reasoning Loops & Orchestration 5.2 Agent Frameworks, MCP & Lifecycle Management 5.3 Action Groups, OpenAPI Schemas & AWS Lambda Integration 5.4 Agent Memory, Session State & Multi-Agent Collaboration Patterns 5.5 Persistent State & Multi-Agent Coordination 5.6 Advanced Agent Prompt Templates & Flow Customization 5.7 Agent Safeguards, Tool Reliability & Cost Control
6 Chapter 6: Workflow Orchestration & Application Integration
6.1 Amazon Bedrock Prompt Flows & Visual Orchestration 6.2 Step Functions Orchestration & Human-in-the-Loop Workflows 6.3 Enterprise Integration: API Gateway, AppSync, and EventBridge 6.4 Hybrid Integration, GenAI Gateways & CI/CD Tooling
7 Chapter 7: AI Safety & Guardrails for Amazon Bedrock
7.1 Guardrails Architecture, Denied Topics & Content Filters 7.2 Content Safety, Defense in Depth & Threat Detection 7.3 Sensitive Information Filters & PII Redaction/Masking 7.4 Contextual Grounding Checks & Hallucination Prevention
8 Chapter 8: Security, Access Control & Network Architecture
8.1 IAM Least Privilege & Resource Policies for Bedrock 8.2 PrivateLink VPC Endpoints & Network Isolation 8.3 Encryption with AWS KMS & Cross-Account Access Patterns
9 Chapter 9: Governance, Auditing & Operational Logging
9.1 SageMaker Model Cards & AI Governance Frameworks 9.2 Lineage, Fairness, Transparency & Continuous Governance 9.3 Invocation Logging, CloudTrail Auditing & Observability 9.4 Responsible AI, Bias Mitigation & Red Teaming Methodologies
10 Chapter 10: Performance, Throughput & Cost Optimization
10.1 On-Demand vs Provisioned Throughput & Capacity Planning 10.2 Capacity Measurement, Scaling Patterns & Resilience 10.3 Batch Inference & Bedrock Intelligent Prompt Routing 10.4 Intelligent Prompt Routing & Application Eligibility 10.5 Prompt Caching, Token Optimization & Latency Reduction
11 Chapter 11: Testing, Evaluation & Troubleshooting GenAI Solutions
11.1 Amazon Bedrock Model Evaluation (Automatic & Human Workflows) 11.2 Human, RAG & Continuous Evaluation 11.3 Evaluation Metrics & RAG Quality Benchmarking (Ragas, ROUGE, BLEU) 11.4 RAG and Agent Performance Evaluation 11.5 CloudWatch Metrics, Throttling & Operational Observability 11.6 Quota Diagnosis, Retry Control & Operational Troubleshooting 11.7 Troubleshooting Common GenAI Failure Modes & Agent Traces 11.8 Prompt Maintenance, Content Handling & Deployment Validation
2.1 Managed RAG Architecture with Bedrock Knowledge Bases
Key Takeaways Explain This Topic AI
Use Retrieve when evidence needs custom DLP, authorization, or reranking before model invocation.
Do not invent a session ID on the first RetrieveAndGenerate request; Bedrock returns it for later turns.
Custom citation prompts must preserve the documented output-format-instructions placeholder and other model-specific requirements.
Last updated: September 2026
2.1 Managed RAG Architecture with Bedrock Knowledge Bases
Retrieval-augmented generation (RAG) supplies a foundation model with external evidence at request time. Amazon Bedrock Knowledge Bases can manage data-source ingestion, parsing, chunking, embeddings, vector storage integration, retrieval, response generation, and citations. The developer still owns source authorization, data quality, synchronization policy, retrieval evaluation, and the application controls around the managed workflow.
Ingestion and runtime are separate planes
During ingestion, a data source is read, parsed, divided into chunks, embedded with the configured embedding model, and written with metadata to a supported vector store. Source and vector-store support changes over time, so verify the current Region and connector documentation rather than treating a memorized list as universal.
Ingestion is asynchronous. Adding an object to a source does not itself prove that the new content is searchable. Start and monitor an ingestion job, check failed-document statistics, and confirm that deleted or changed source records are reflected as intended. For event-driven freshness, an application can debounce source events and start synchronization safely; it should not launch one overlapping job for every object in a large upload.
At runtime, the system embeds or transforms the query, applies filters, retrieves candidate passages, optionally reranks or reformulates, and either returns the passages or sends them to a generation model. Metadata filters are part of authorization design, but they do not replace source-system access controls. For strict tenant isolation, use defense in depth: separate resources where required, enforce application identity, validate filters server-side, and test for cross-tenant retrieval.
Retrieve versus RetrieveAndGenerate
API path What Bedrock returns Choose it when
Retrieve Retrieved content, locations, metadata, and scores The application needs custom reranking, DLP inspection, prompt construction, or a nonstandard generator
RetrieveAndGenerate A generated response plus citation information A managed end-to-end RAG path meets the workflow requirements
Retrieve exposes the intermediate evidence. That makes it suitable when passages must pass through a proprietary authorization check, data-loss-prevention scanner, or custom cross-encoder before generation. RetrieveAndGenerate reduces application code but offers fewer custom interception points.
For RetrieveAndGenerate, do not invent a session identifier on the first request. Bedrock generates the session ID, and the client returns it on later turns when it wants the same conversational session. Store it as sensitive application state and do not mix it among tenants.
Generation prompt placeholders and citations
A custom generation prompt must include the search-results placeholder. Placeholder requirements vary by model and prompt type. Current Knowledge Bases documentation also states that the output-format-instructions placeholder is required for citations to appear in the response. The query placeholder is required for some models and automatically included for others. Therefore, copy the current template requirements for the selected model rather than assuming that search results and query are the only required variables.
A safe custom template distinguishes instructions, retrieved evidence, and user input. It tells the model to acknowledge insufficient evidence, but wording alone does not enforce factuality. Preserve the output-format instructions when citations are required, validate the returned citation spans, and render source links only after applying authorization rules.
Worked authorization path
Consider a human-resources assistant serving several subsidiaries. The application authenticates the employee, resolves subsidiary and role claims server-side, and constructs an allowlisted metadata filter. Retrieve returns candidate passages and source locations. The application rejects any passage whose metadata does not satisfy the claims, applies a DLP scan, reranks the remaining evidence, and calls Converse with a validated prompt. Citations are mapped back to an authorized document route rather than exposing a raw storage URL.
This flow makes trust boundaries explicit. The browser cannot choose its own tenant filter. The model never grants access. Retrieved text is untrusted content and is delimited so instructions inside it are not treated as system policy. Logs store request and document identifiers with controlled access rather than copying sensitive paragraphs.
For a lower-risk public documentation assistant, RetrieveAndGenerate may be the better managed path. The decision is driven by interception and control requirements, not an assumption that custom code is always more secure.
Session boundary
Treat the Bedrock-generated session identifier as tenant-scoped state. Bind it to the authenticated conversation, expire it with the application session, and reject a client-supplied identifier that belongs to another user. Multi-turn convenience does not replace the application's own authorization and retention policy.