I Thought AWS Bedrock Was Just Relaying Models — Turns Out It Runs Them Directly#

It Started With a Small Question#

I knew that with AWS Bedrock you could call external LLMs (Large Language Models) like Claude or GPT. But the more I thought about it, the stranger it seemed. Claude is a model owned by Anthropic, and GPT is a model owned by OpenAI. These are another company’s core assets — so how on earth does AWS get to offer them inside its own service?

I had a vague assumption:

AWS must sign a contract with Anthropic or OpenAI, connect some kind of dedicated line, and forward requests over to them — a relay (proxy) approach.

In other words, I imagined Bedrock was merely a front desk, and the actual computation happened on the model owner’s servers. But when I looked into it, I found claims that “Bedrock runs these models directly on its own infrastructure.” Those are two completely different pictures. I dug in to find out which one was true, and in the process a few of my assumptions were shattered. This is that record.

The Conclusion First: Direct Execution Was Correct#

After researching, my original assumption turned out to be wrong. Bedrock is not a relay station that forwards requests outward. It is a fully managed service that takes model weights — which AWS receives through licensing / contracts — places them on AWS’s own infrastructure, and performs inference directly.

In other words, when I call Claude through Bedrock, the request does not travel over to Anthropic’s servers. A Claude model deployed inside an AWS data center generates the response right there and returns it. Each model runs inside an isolated account operated exclusively by the Bedrock service team, and even the company that built the model cannot access that environment.

The Strongest Evidence Was That Data Never Leaves#

If it really were the dedicated-line relay I had imagined, the prompts users enter would eventually have to flow to Anthropic’s or OpenAI’s servers. But AWS’s official position was the exact opposite.

• “With Amazon Bedrock, your content is not used to improve the base models and is not shared with any model providers.” (Amazon Bedrock FAQ )
• Anthropic’s official documentation likewise states plainly that “Claude in Amazon Bedrock runs on AWS-managed infrastructure, and Anthropic personnel have no access to the inference infrastructure.”

The very reason such guarantees are possible is that the model runs directly inside the AWS security boundary. If it were a structure that forwarded requests outward, that promise could never hold in the first place. This is the point where I became certain: “Ah, I had it backwards.”

The Misunderstanding Buried in the Word “Contract”#

Interestingly, my assumption was not entirely wrong. The part about AWS signing contracts with model companies is correct. It was just the content of those contracts that differed from what I imagined.

• What I imagined: “a contract to connect requests over a dedicated line”
• The reality: “a contract granting the right (license) to host and sell the model on AWS infrastructure”

To put it as an analogy: the AWS I pictured was “a switchboard operator connecting your call to Anthropic,” but the real AWS is closer to “a franchise outlet that takes Anthropic’s model and runs it directly in its own store.” (For reference, AWS is also a major investor in Anthropic.)

Which Models Are Actually on Bedrock?#

So which models can you actually use on Bedrock? As of now, the lineup looks roughly like this.

One pattern stood out here. Open-weight models with publicly available weights (Llama, Gemma, Mistral, etc.) can be hosted by AWS naturally, while closed models kept secret (Claude, GPT) are hosted by receiving the weights through separate commercial contracts. Notably, even within Google’s own models, the open-weight Gemma is available, but the closed flagship Gemini is absent (for commercial / competitive reasons). And it was precisely at this point — “hosting closed models by receiving their weights” — that a bigger question arose.

What I Really Wondered: Did OpenAI’s Core Assets Just Move to AWS?#

A frontier model like GPT-5.5 is OpenAI’s most secret asset. And yet, if “AWS receives the weights and runs them directly,” then doesn’t that mean OpenAI’s core assets have been handed over wholesale to AWS, a potential competitor? (AWS has its own model, Nova, so from OpenAI’s perspective it amounts to entrusting your safe to a rival.)

Digging into this, I learned the most fascinating fact: the weights do run on AWS hardware, but the design ensures that even AWS cannot extract those weights.

First, You Have to Distinguish Two Kinds of Models#

The starting point of the confusion was this. The OpenAI models on AWS are two kinds with completely different characters.

1. Open-weight models (gpt-oss-120b, gpt-oss-20b): Models OpenAI deliberately released under the Apache 2.0 license. Anyone can download and run them on their own infrastructure, so these are not “core assets that could be stolen.”
2. Frontier models (GPT-5.5, GPT-5.4, Codex): The genuine secret assets. And these are not the case of weights being “handed over” to AWS in plaintext.

My concern fell under category 2, so that’s where I needed to find the answer.

The Core: Weights Run Inside a Safe That Even AWS Can’t Open#

AWS solves this problem with an inference engine called Mantle and Nitro Enclaves (confidential computing) technology. The mechanism is quite clever.

• The model provider (OpenAI) delivers the weights encrypted via AWS KMS (Key Management Service) using envelope encryption.
• These encrypted weights are sealed so they can only be decrypted in a specific verified execution environment (enclave). KMS releases the decryption key only when that environment’s cryptographic measurements (attestation) match.
• The decrypted weights exist only within that enclave’s memory and are never exposed beyond its boundary.

On top of this comes the Zero Operator Access (ZOA) design. AWS’s Mantle design document explains it this way:

In Mantle, there is no technical means for any AWS operator to sign in to the underlying compute systems or access customer data. Interactive tools like SSH, Session Manager, and serial consoles are not installed anywhere.

In other words: no SSH, no console access, and no API path that touches the data exists at all. Even if an AWS employee wanted to, the design blocks any route to dump the weights from memory.

Summed Up With the Safe Analogy#

What OpenAI did with AWS was not “hand over the keys to the safe wholesale.”

• It placed an encrypted safe inside the AWS building (data center), but sealed that safe so only a verified, unmanned robotic arm can open it.
• The landlord (AWS) provides the space and electricity (GPU / hardware), but cannot peer inside the safe.
• When a guest (the user) sends a request, the robotic arm works inside the safe and returns only the result.

That is how AWS can offer a two-way guarantee that “neither customer data nor even the model provider can access the inference environment.” Without this technical isolation, a company like OpenAI would have had no reason to put its model on AWS, which holds a competing model.

Commercially, the Asset Still Belongs to OpenAI#

Beyond the technical isolation, the business structure pointed in the same direction.

• Bedrock’s GPT pricing is set to be identical to OpenAI’s direct API rates. AWS is not “taking the model and selling it cheap”; it acts as a distribution channel that preserves OpenAI’s revenue model as is.
• This is part of OpenAI’s strategy of beginning multi-cloud distribution (AWS, Google Cloud) after its exclusivity deal with Microsoft was loosened in early 2026. From OpenAI’s standpoint, it didn’t hand over an asset — it widened its sales channels.

In Closing — What I Had Gotten Wrong#

Here is a summary of the assumptions this investigation corrected for me.

1. Direct execution, not relay : Bedrock is not a front desk forwarding requests outward; it runs the models directly on AWS infrastructure.
2. The contract was real, but its content differed : it was not a dedicated-line connection contract, but a license to host / sell the model.
3. Hosting depends on the model’s nature : open-weight models (Llama, Gemma, etc.) are hosted naturally, while closed models (Claude, GPT) are hosted by receiving weights through separate commercial contracts. That’s why, even within Google, Gemma is present but Gemini is not.
4. The asset was not handed over : the weights run on AWS hardware, but thanks to cryptographic sealing and zero operator access, even AWS cannot extract / read them.

What began as simple curiosity — “How does a service offer another company’s model?” — eventually led me, by following the answer, to a much larger theme: how trust in the cloud era is engineered technically. What impressed me most is that trust is built not through a “trust us” policy, but through a structure that says “we removed the access path itself.”

Running another company’s core asset in your own data center while guaranteeing to both its owner and the customer that “no one can see it.” That seemingly contradictory promise, solved through cryptography — that was Bedrock.