AWS Certified Generative AI Developer Professional Study Notes (AIP-C01)

These notes cover the AWS Certified Generative AI Developer Professional exam (AIP-C01). The material is organized the way we can easy learn from : start with the platform you build on, move into how a request flows through an agent, then into grounding answers with your own data, then into the guardrails, security, cost, and governance controls an AWS developer is expected to apply before anything ships. Read it top to bottom once, then use the tables as quick recall drills before exam day.

1. Amazon Bedrock, the Platform You Build On

Amazon Bedrock is the fully managed generative AI service at the center of this exam. It gives you access to many foundation models through one API, lets you build agentic and retrieval augmented generation applications, and layers security, evaluation, and observability on top, all without you having to provision a single GPU.

It helps to think of the whole ecosystem as six layers working together instead of memorizing a long feature list.

• Application layer, the web and mobile apps where a person actually starts a request
• Orchestration layer, the reasoning and planning brain, made up of Agents, AgentCore, and Flows
• Foundation models, the engines that orchestration calls to generate text, reasoning, or decisions
• Data sources, the vector stores that orchestration pulls context from to ground its answers
• Security, which wraps every other layer and decides who can access what and what a model is allowed to do
• Governance and observability, which continuously monitors, evaluates, and audits the whole system

Note

• Bedrock is an inference and orchestration platform, not a training platform
• No component reaches a foundation model or a data source without passing through orchestration
• Bedrock does not use your prompts or data to train its underlying models, and your data is not shared across other customers

2. Application Layer

This is where end users interact with generative AI, and it is deliberately kept simple. No business logic and no model calls happen here, which keeps security centralized and lets you add new client surfaces without touching the AI logic underneath.

2.1 Web Apps

Browser based dashboards, chatbots, internal tools, and customer portals send requests to a Bedrock backed backend. A web app is a client that calls the orchestration layer through API Gateway and Lambda or directly through an SDK. It never talks to a foundation model directly, everything is proxied through orchestration so guardrails and IAM permissions are always enforced.

2.2 Mobile Apps

Native or cross platform apps extend the same capabilities to on the go, personal device contexts such as voice assistants and in app support bots. They authenticate through Amazon Cognito and IAM, then call the same orchestration APIs, typically consuming streaming responses for a responsive chat feel.

3. Orchestration Layer, the Reasoning Brain

Orchestration decides what steps to take, which model to call, what data to retrieve, and how to sequence a multi step task. This is where most of the agentic intelligence in a Bedrock application actually lives.

3.1 Amazon Bedrock Agents

Bedrock Agents is a managed capability that lets a foundation model break a natural language goal into a sequence of steps, call APIs or Lambda functions, and return a completed task rather than a simple chat reply. It sits between the app and the model, interpreting the request, deciding which internal APIs or knowledge bases to call, and orchestrating the back and forth until the task finishes. AWS now refers to this original feature as Agents Classic, and is actively steering new builders toward AgentCore, described next.

3.2 Amazon Bedrock AgentCore

AgentCore is a full, modular, production grade platform for building, deploying, securing, and scaling AI agents. It is framework agnostic, working with LangGraph, CrewAI, Strands, LlamaIndex, or your own custom agent code, and it is model agnostic, working with any model in or outside Bedrock. AgentCore reached general availability in October 2025 and is where AWS is investing most heavily for agentic workloads.

AgentCore is made up of composable services you can use together or independently.

• Runtime, a secure serverless hosting environment for each agent session
• Memory, persistent short term and long term memory across turns and sessions
• Gateway, which turns existing APIs, Lambda functions, and OpenAPI specs into standardized tool calling endpoints using the Model Context Protocol
• Identity, which manages inbound authentication of who can call an agent and outbound authorization of what the agent can call on a user's behalf
• Observability, step by step tracing of what the agent did, built on OpenTelemetry and integrated with CloudWatch
• Policy, real time deterministic controls on what an agent can do with a tool, enforced outside the agent's own reasoning so it cannot be talked around even if it has been prompt injected

Bedrock Agents Classic vs Bedrock AgentCore

3.3 Amazon Bedrock Knowledge Bases

Knowledge Bases is a fully managed retrieval augmented generation pipeline. It ingests your documents, chunks them, generates embeddings, stores those embeddings in a vector store, and retrieves the relevant chunks at query time. This grounds model answers in your own private or organizational data instead of relying only on the model's training data, which reduces hallucination and enables up to date, company specific answers. Agents and AgentCore call Knowledge Bases during reasoning, and the retrieved chunks get injected into the prompt sent to the foundation model.

3.4 Amazon Bedrock Flows

Flows, sometimes called Prompt Flows, is a visual builder for chaining prompts, model calls, knowledge base lookups, Lambda functions, and conditional logic into a defined workflow. Choose Flows over Agents when the sequence of steps is known in advance and does not need the model to plan dynamically, useful for predictable business processes.

3.5 Inference Profiles

An inference profile is a configuration construct that defines how a model invocation is routed, for example a cross region profile that spreads requests across AWS regions for throughput and availability, or a profile used to track and attribute usage and cost. When Agents, Flows, or AgentCore invoke a model, they invoke it through an inference profile rather than a single hardcoded model and region endpoint.

4. RAG on Bedrock

Retrieval Augmented Generation is the technique that separates a generic chatbot from a system that can accurately answer questions about your documents, policies, and internal data. Understand the full pipeline, both what happens once when you set up a knowledge base and what happens on every single query.

4.1 Ingestion Pipeline, What Happens Once

1. Connect the data source, Amazon S3, SharePoint, Confluence, Google Drive, OneDrive, Salesforce, or a web crawler
2. Parse each document, extracting text and structure from PDF, DOCX, HTML, and similar formats, with managed knowledge bases automatically choosing an optimal parsing strategy per connector and preserving metadata, embedded images, and thread context
3. Chunk the parsed text into manageable, searchable segments using a fixed size, semantic, or hierarchical strategy
4. Embed each chunk into a vector using an embedding model such as Titan Text Embeddings V2 or Cohere Embed
5. Store the embeddings in a vector index, keeping a mapping back to the original source document and chunk

A sync process keeps the knowledge base current as source documents change, either on a schedule or triggered by events such as S3 notifications.

4.2 Retrieval Pipeline, What Happens on Every Query

1. The user's query is converted into a vector using the same embedding model used at ingestion time
2. The vector index is searched for chunks that are semantically similar to the query vector, not just keyword matches
3. The most relevant chunks are returned, Top K, with a default of three, increasable for complex questions
4. Optionally, a reranking step reorders the retrieved chunks by relevance for better precision
5. The retrieved chunks are injected into the prompt as additional context
6. The augmented prompt goes to the foundation model, which generates an answer grounded in the retrieved content, often with citations

4.3 Chunking Strategies

Chunking strategy is one of the biggest levers for retrieval quality and is worth testing whenever you change it.

• Fixed size chunking splits text into equal sized blocks, a simple and reproducible baseline
• Semantic chunking splits along natural meaning boundaries instead of a fixed character count
• Hierarchical chunking preserves parent child relationships between larger sections and their sub chunks

4.4 Embedding Models and Multimodal Retrieval

Common Bedrock embedding options include Titan Text Embeddings V2, Titan Multimodal Embeddings, Amazon Nova Multimodal Embeddings, and Cohere Embed. Multimodal retrieval extends the standard RAG workflow to images, video, and audio alongside text, either by embedding the media directly or by captioning it into text first and then embedding that caption. This is useful for searching manuals, policies, and visual content together.

4.5 Agentic Retriever

Managed Knowledge Bases can go beyond a basic match the query to the nearest chunks approach. An agentic retriever plans queries across knowledge bases, connects related concepts across documents, evaluates intermediate results, and reranks before answering, which suits complex, multi part questions that span several topics through a single API call.

5. Vector Stores, the Data Source Layer

Knowledge Bases needs somewhere to store the embeddings it generates. There is no single AWS vector database, there are several supported backends, each inheriting its strengths from what it was originally built for.

AWS Vector Storage Options

Amazon Bedrock Knowledge Bases is not itself a vector database. It is a managed RAG layer that provisions and manages one of the backends above for you. Do not confuse the two on the exam. Watch for scenario cues, billions of vectors plus cost sensitive points to S3 Vectors, and graph relationships plus explainable AI points to Neptune Analytics.

6. Vector Search, Similarity and Search Algorithms

Once embeddings exist, a search algorithm decides how to find the nearest matches quickly.

6.1 Similarity Metrics

• Cosine similarity measures the angle between two vectors, ignoring magnitude, and is the default answer whenever a question emphasizes semantic similarity of text
• Euclidean distance, also called L2, measures straight line distance and matters when a vector's magnitude carries meaning, common with some image or numeric feature embeddings
• Dot product measures both direction and magnitude together, often used with pre normalized vectors or in recommendation systems where the strength of a match matters

6.2 Exact vs Approximate Search

Exact kNN compares a query vector against every vector in the dataset and returns the true nearest neighbors. It scales linearly with the number of vectors and their dimensions, so it is only practical for smaller datasets, roughly tens of thousands of vectors, or when perfect recall matters more than latency. Approximate Nearest Neighbor methods trade a small amount of recall for large gains in speed at scale, and this tradeoff is the single most tested vector search concept on the exam.

Approximate Nearest Neighbor Algorithm Decision Table

7. Guardrails for Amazon Bedrock

Guardrails provide configurable safeguards for building safe, responsible generative AI applications, and they work consistently across any foundation model, Bedrock hosted, self hosted, or third party. They evaluate both user input and model output. A guardrail is a combination of one or more policies, and an account can have several guardrails, each customized to a use case. Guardrails can be attached directly during inference, through InvokeModel, Converse, Agents, or Knowledge Bases, or called independently through the standalone ApplyGuardrail API without invoking a model at all.

7.1 Content Filters

Detects and filters harmful text and image content across categories such as hate, insults, sexual content, violence, misconduct, and prompt attacks, meaning jailbreaks and prompt injection attempts. Filter strength is configurable per category, none, low, medium, or high, and can differ between the prompt side and the response side. The standard tier extends detection into code elements such as comments and variable names and supports many languages.

7.2 Denied Topics

Lets you define custom topics that are off limits, blocking them if detected in either the user query or the model's response. Best practice is to be specific rather than vague, a scoped instruction avoids false positives that a broad instruction like do not discuss politics would create.

7.3 Word Filters

Blocks a custom list of exact words and phrases, including a ready to use profanity filter, and is useful for blocking competitor names or specific offensive terms.

7.4 Sensitive Information Filters, PII

Detects and blocks or masks personally identifiable information such as names, emails, and government identifiers, along with custom regex entities. Detection is probabilistic and context dependent, not only pattern matching. Best practice is to mask rather than fully block, which keeps a response useful instead of failing outright.

7.5 Contextual Grounding Checks

Detects hallucinations in model responses by flagging or blocking answers that are not grounded in the source information or that are irrelevant to the question asked. This is especially useful in RAG applications, since it checks whether the answer actually matches the retrieved passages.

7.6 Automated Reasoning Checks

Uses formal logic, not just a probabilistic model, to catch factual errors from hallucinations. You define policies in natural language, and the system evaluates whether outputs comply with those logical rules, for example ensuring a chatbot only recommends in stock products or that financial advice follows a specific regulatory rule.

7.7 Safeguard Tiers

The standard tier is recommended for most production deployments, supports many languages and code level protection, and requires opting into cross region inference. The classic tier trades some accuracy for lower latency and suits simple moderation needs.

Note

• A question describing prevent the model from discussing a topic, or stop leaked PII in responses, points to Guardrails, not IAM or encryption, because those control access rather than content
• In an agentic system, guardrail checks feed into Policy and are enforced outside the agent's own reasoning, so a manipulated agent cannot argue its way around a rule

8. Security for Generative AI Systems

Security in this domain is defense in depth, with identity, network, and content controls each covering a different attack surface.

• AWS IAM enforces least privilege access, every component, Agents, AgentCore, Knowledge Bases, and Flows, runs under an IAM role or policy, and this is the foundational access control layer every other piece of the system trusts
• VPC Endpoints, using AWS PrivateLink, keep sensitive traffic, prompts, retrieved documents, and model responses, inside AWS's private network instead of the public internet, important for compliance sensitive workloads
• Encryption applies at rest, using AWS KMS managed keys, and in transit, using TLS, and the exam often tests whether you know both apply, not just one
• The Shared Responsibility Model still applies, AWS secures the underlying infrastructure while you are responsible for your data, IAM configuration, encryption choices, and application level defenses such as prompt injection handling

9. Governance and Observability

This layer answers the question, is the system behaving correctly and can we prove it. Three services are commonly confused, and the distinction between them is a favorite exam trap.

• Amazon CloudWatch collects latency, error rate, invocation counts, and custom metrics from every layer, and is the central dashboard for whether the system is running normally, it is the health and performance monitoring tool
• AWS X-Ray traces a single request as it hops across multiple services, reconstructing the full call graph so you can pinpoint exactly where latency or errors were introduced in a multi step agentic request
• AWS CloudTrail records every API call, who called what, when, and from where, providing a tamper evident audit trail for compliance and security investigations, it is the accountability and audit tool, not a performance tool

Bedrock Evaluation runs alongside orchestration, sampling real or synthetic traffic and scoring it against quality metrics, often used to gate whether a new model version or agent configuration is promoted to production.

Note

• Evaluation tells you if the AI is good, CloudWatch and X-Ray tell you if the system is healthy and fast, CloudTrail tells you who did what
• A common wrong answer swaps CloudTrail and CloudWatch, remember CloudTrail equals audit, CloudWatch equals metrics

10. Model Customization Spectrum

This is one of the most tested concepts on the exam. Know the order of increasing cost, complexity, and data requirement.

1. Prompt engineering, the cheapest and fastest option, no training involved, just adjusting wording, instructions, and examples, including zero shot, few shot, and chain of thought prompting
2. Retrieval Augmented Generation, adds external or proprietary knowledge at inference time without retraining the model, the cheapest fix for a knowledge gap or hallucination problem
3. Fine tuning, retrains model weights on labeled, domain specific data, needed when the model must learn a new behavior or style, not just new facts
4. Continued pre training, further trains on large volumes of unlabeled domain data, the most expensive common option, used to deeply adapt a model to a specialized domain such as legal or medical text
5. Training from scratch, the most expensive and complex option, rarely the right exam answer unless the scenario has explicitly ruled out everything else

Note

• The model does not know about our recent or private data points to RAG
• The model knows the facts but answers in the wrong tone, format, or style points to fine tuning

11. Inference Optimization

Once a model is chosen, the next question is how to run it efficiently. Almost every optimization question is really asking which two of cost, latency, and accuracy you are prioritizing.

• On demand inference, pay per use, best for variable or unpredictable traffic, the simplest option
• Provisioned Throughput, reserved capacity for predictable, high volume workloads that need consistent latency, higher cost but guaranteed throughput
• Batch inference, processes many requests together asynchronously, the lowest cost option, suited to summarization and document analysis at scale where an immediate answer is not required
• Quantization, reduces model precision, for example from FP32 to INT8, cutting memory and compute cost at a small accuracy tradeoff
• Model distillation, trains a smaller student model to mimic a larger teacher model for cheaper inference, with some accuracy loss
• SageMaker Neo, compiles and optimizes a trained model for specific target hardware, including edge devices

12. Evaluating Foundation Models and Agents

There are two broad evaluation categories, and the exam expects you to know when each applies.

• Automatic or programmatic evaluation, metric based, fast, cheap, and reproducible, using measures such as ROUGE, BLEU, BERTScore, perplexity, and F1, good for objective tasks such as summarization or translation quality
• Human evaluation, subjective judgment of helpfulness, tone, and nuanced factual correctness, slower and more expensive but able to catch what automatic metrics miss

Amazon Bedrock Model Evaluation lets you compare foundation models side by side using automatic metrics or human evaluators, on your own data or built in datasets, and is the managed answer for how do I choose the best model for my use case. FMEval is the open source library approach specifically for quantifying toxicity, bias, and accuracy risk in LLM outputs. SageMaker Clarify is broader, covering bias and explainability across traditional ML as well as generative AI, both pre deployment detection and post deployment monitoring. If a question asks about explainability, or why did the model make this prediction, the answer is Clarify, not FMEval, since FMEval is about risk and quality scoring rather than per prediction explanation.

13. SageMaker, the ML Lifecycle Behind Custom Models

A generative AI developer is also expected to know where SageMaker fits when a project needs custom models, embeddings, or fine tuning infrastructure rather than a purely Bedrock hosted approach. The lifecycle runs in five stages tied together by two cross cutting components.

Stage 1, Data and Feature Engineering

Get raw data into a clean, labeled, ML ready format. Amazon S3 is the central data lake almost every other component reads from. Data Wrangler is a visual, low code tool for import, cleaning, and transformation. Ground Truth is a managed data labeling service combining human annotators with ML assisted labeling. Processing Jobs run custom pre or post processing scripts on managed infrastructure. Feature Store is a versioned repository for ML features so training and inference use identical feature definitions, avoiding training and serving skew.

Stage 2, Model Build and Training

JumpStart is a hub of pre trained foundation models, Llama, Mistral, Qwen, Gemma, and Falcon among them, deployable as is or fine tuned on your own data. Canvas is a no code visual tool that lets business analysts build predictive models without writing Python. Notebooks, through SageMaker Studio, are managed Jupyter environments preconfigured with common ML frameworks. Training Jobs offer managed, on demand compute for your own training code at scale. Autopilot automatically explores algorithms and hyperparameters to produce a strong baseline model. HyperPod provides purpose built, resilient infrastructure for distributed training of foundation models across thousands of accelerators with automatic fault recovery.

Stage 3, Evaluation and Governance

Clarify detects statistical bias and explains individual predictions through feature attribution. FMEval quantifies risk of inaccurate, toxic, or biased output specifically for foundation models. Evaluation Jobs run a model against defined metrics and datasets to score quality before promotion. Experiments track and compare multiple training runs to identify the best configuration. Model Registry catalogs versions, tracks approval status, and manages the handoff from training to deployment, including cross account deployment. Model Cards document a model's intended use, performance, limitations, and risk considerations for governance review.

Stage 4, Deployment and Inference

Real time Endpoints provide persistent, low latency HTTPS endpoints for synchronous predictions. Serverless Inference scales to zero and charges per millisecond of use, ideal for intermittent traffic. Batch Transform processes large offline datasets in bulk without a persistent endpoint. Asynchronous Inference queues requests for large payloads or long running jobs. Neo compiles and optimizes a trained model to run efficiently on specific target hardware.

Stage 5, Monitoring and Feedback

Model Monitor automatically detects data drift and model quality drift in production traffic. Clarify continues bias monitoring after deployment as real world data shifts. CloudWatch captures endpoint latency, invocation counts, errors, and custom monitoring metrics.

Cross Cutting, Pipelines and Retraining

SageMaker Pipelines is a CI CD style orchestration service chaining steps from all five stages into a single, automated, repeatable workflow, a DAG of steps, enabling consistent, auditable, versioned ML workflows instead of manual, one off runs. The retraining loop is the feedback connection from monitoring back to data and feature engineering, triggered by drift detected in Model Monitor or Clarify, kicking the pipeline off again so the model does not silently degrade over time.

14. Amazon Q Family

Amazon Q is a family of ready made assistants, not a single product, and the exam expects you to pick the right variant for a scenario.

• Amazon Q Business, a workplace assistant connected to your company's enterprise systems, answers questions and summarizes documents grounded in organizational data
• Amazon Q Developer, a coding assistant inside the IDE, AWS Console, and CLI, handling code generation, debugging, security scanning, and legacy code modernization such as Java 8 to Java 21 upgrades
• Amazon Q in QuickSight, natural language business intelligence and data querying
• Amazon Q Connect, real time agent assist for contact centers

Note

• Amazon Q Developer's access to account or billing information is scoped to the user's existing IAM permissions, Q adds convenience, not additional privilege
• A scenario describing no ML expertise needed, an out of the box assistant, points to Amazon Q, not Bedrock
• A scenario describing a fully custom conversational application with your own model choice and prompt logic points to Bedrock plus Agents or Knowledge Bases, not Amazon Q, which is a fixed, managed product

15. Foundation Models Available on Bedrock

Bedrock is model agnostic at the platform level, so the underlying foundation model is one interchangeable engine among several, invoked through an inference profile whichever model is chosen.

• Claude from Anthropic, chosen for strong reasoning, long context handling, nuanced instruction following, and safety conscious behavior, frequently the default for agentic workloads
• Amazon Nova, AWS's own current generation foundation model family, replacing the earlier Titan text generation models, spanning fast low cost text models, multimodal models, and image and video generation, with a context window that scales up to a million tokens on the largest variants
• Titan Embeddings, AWS's own embedding model family, still actively used and the bridge that turns raw documents into the vectors stored in a vector database or S3 Vectors index, note that the earlier Titan Text generation models, Express, Lite, and Premier, have been retired from Bedrock in favor of Nova
• Llama from Meta, an open weight family offered as a hosted, managed option, often chosen for cost, fine tuning flexibility, or specific licensing needs

Note

• If a question still references Titan Text Express, Lite, or Premier as the current recommended generation model, treat Amazon Nova as the up to date answer, Titan Embeddings remains the current answer for embeddings
• Swapping between models in a multi model strategy, a cheaper model for simple tasks and a stronger model for complex reasoning, happens through the same orchestration and inference profile setup regardless of which model family is chosen

16. API Layer Choices for GenAI Applications

How a client talks to your orchestration layer matters as much as which model sits behind it.

16.1 Amazon API Gateway

A fully managed service for creating, securing, and scaling REST, HTTP, and WebSocket APIs, commonly the entry point between client applications and Lambda or Bedrock.

• Synchronous invocation, the client waits for the model to finish, common for chatbots, summarization, and question answering, but REST and HTTP APIs carry roughly a twenty nine second timeout, so long running generative responses can fail before completion
• WebSocket APIs maintain a persistent, bidirectional connection, ideal for token by token streaming from an LLM, reducing perceived latency for long responses
• Asynchronous invocation submits a request without waiting, useful for long running tasks such as large document summarization or batch inference, often orchestrated with SQS, EventBridge, or Step Functions to avoid timeout limits entirely

16.2 AWS AppSync

A fully managed GraphQL service that lets a client request exactly the data it needs from multiple backend sources in a single query, and supports real time subscriptions over WebSockets for live, collaborative generative AI interfaces such as a shared writing application streaming updates to multiple connected users.

17. Exam Notes