Cross-Region Inference with Amazon Bedrock: Optimizing Performance, Cost, and Compliance
Amazon Bedrock cross-region inference optimizes AI model deployment by intelligently routing requests across global infrastructure, balancing throughput capacity with regional compliance requirements. This architecture eliminates additional fees while potentially doubling request quotas, offering geographic profiles for strict data residency or global profiles for maximum throughput and cost savings of approximately 10%
Amazon Bedrock offers two types of cross-region inference capabilities to help you optimize throughput, manage costs, and meet compliance requirements. This comprehensive guide explains the differences between Geographic and Global cross-region inference, with detailed IAM policy and Service Control Policy (SCP) implementation examples.
Key Takeaways:
- Geographic cross-region inference keeps data within regional boundaries (US, EU, APAC)
- Global cross-region inference routes to any AWS commercial region for ~10% cost savings
- Proper IAM policies and SCPs are critical for security and compliance
- Step-by-step implementation guides included for both options
Table of Contents
What is Cross-Region Inference?
Cross-region inference allows Amazon Bedrock to automatically route your model inference requests across multiple AWS regions to optimize performance and manage capacity. When using on-demand inference, your requests might be restricted by service quotas or during peak usage times. Cross-region inference helps you seamlessly manage unplanned traffic bursts by utilizing compute capacity across different AWS regions. [1]
How It Works
Cross-region inference operates through inference profiles, which define:
- A foundation model (FM) to use
- The AWS regions to which requests can be routed
- Routing logic for optimal performance
Side-by-Side Comparison
Feature | Geographic Cross-Region | Global Cross-Region |
|---|---|---|
Routing Scope | Within geographic boundaries (US, EU, APAC) | Any AWS commercial region worldwide |
Data Residency | Maintained within geography | No geographic restrictions |
Cost | Standard pricing | ~10% savings[1] |
Throughput | Higher than single-region | Highest available[2] |
IAM Policy Complexity | Standard 2-part policy | 3-part policy with global FM resource |
SCP Requirements | Allow specific destination regions | Allow "aws:RequestedRegion": "unspecified" |
Best For | Regulated industries, compliance needs | Cost optimization, maximum performance |
IAM Policy Configuration (Detailed)
Security Best Practice: Always follow the principle of least privilege when configuring IAM policies. Grant only the permissions necessary for your specific use case.
Prerequisites
Before using inference profiles, ensure your IAM role has the necessary permissions. If your role has the
AmazonBedrockFullAccess AWS-managed policy, you can skip custom policy creation. Otherwise, follow the steps below. [3] Basic IAM Policy for All Inference Profiles
This policy allows a role to perform inference profile-related actions and run model inference using all foundation models and inference profiles:
IAM Policy: Basic Inference Profile Access
{ "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "bedrock:InvokeModel*", "bedrock:CreateInferenceProfile" ], "Resource": [ "arn:aws:bedrock:*::foundation-model/*", "arn:aws:bedrock:*:*:inference-profile/*", "arn:aws:bedrock:*:*:application-inference-profile/*" ] }, { "Effect": "Allow", "Action": [ "bedrock:GetInferenceProfile", "bedrock:ListInferenceProfiles", "bedrock:DeleteInferenceProfile", "bedrock:TagResource", "bedrock:UntagResource", "bedrock:ListTagsForResource" ], "Resource": [ "arn:aws:bedrock:*:*:inference-profile/*", "arn:aws:bedrock:*:*:application-inference-profile/*" ] } ]}IAM Policy for Geographic Cross-Region Inference
For geographic cross-region inference (e.g., US regions only), use this policy to restrict access to a specific inference profile:
IAM Policy: US Geographic Cross-Region (Claude 3 Haiku Example)
{ "Version": "2012-10-17", "Statement": [ { "Sid": "AllowUSInferenceProfile", "Effect": "Allow", "Action": [ "bedrock:InvokeModel*" ], "Resource": [ "arn:aws:bedrock:us-west-2:111122223333:inference-profile/us.anthropic.claude-3-haiku-20240307-v1:0" ] }, { "Sid": "AllowUSRegionModels", "Effect": "Allow", "Action": [ "bedrock:InvokeModel*" ], "Resource": [ "arn:aws:bedrock:us-east-1::foundation-model/anthropic.claude-3-haiku-20240307-v1:0", "arn:aws:bedrock:us-west-2::foundation-model/anthropic.claude-3-haiku-20240307-v1:0" ], "Condition": { "StringLike": { "bedrock:InferenceProfileArn": "arn:aws:bedrock:us-west-2:111122223333:inference-profile/us.anthropic.claude-3-haiku-20240307-v1:0" } } } ]}Important: Replace
111122223333 with your actual AWS account ID and adjust regions as needed for your use case.Key Points:
- First statement grants access to the inference profile
- Second statement grants access to foundation models in specific US regions
- Condition ensures model can only be invoked through the specified inference profile
IAM Policy for Global Cross-Region Inference (3-Part Policy)
Global cross-region inference requires a three-part IAM policy to enable routing to any AWS commercial region worldwide: [2]
IAM Policy: Global Cross-Region Inference (Complete 3-Part Policy)
{ "Version": "2012-10-17", "Statement": [ { "Sid": "GrantGlobalInferenceProfileRegionAccess", "Effect": "Allow", "Action": "bedrock:InvokeModel", "Resource": [ "arn:aws:bedrock:us-east-1:123456789012:inference-profile/global.anthropic.claude-sonnet-4-5-20250929-v1:0" ], "Condition": { "StringEquals": { "aws:RequestedRegion": "us-east-1" } } }, { "Sid": "GrantGlobalInferenceProfileInRegionModelAccess", "Effect": "Allow", "Action": "bedrock:InvokeModel", "Resource": [ "arn:aws:bedrock:us-east-1::foundation-model/anthropic.claude-sonnet-4-5-20250929-v1:0" ], "Condition": { "StringEquals": { "aws:RequestedRegion": "us-east-1", "bedrock:InferenceProfileArn": "arn:aws:bedrock:us-east-1:123456789012:inference-profile/global.anthropic.claude-sonnet-4-5-20250929-v1:0" } } }, { "Sid": "GrantGlobalInferenceProfileGlobalModelAccess", "Effect": "Allow", "Action": "bedrock:InvokeModel", "Resource": [ "arn:aws:bedrock:::foundation-model/anthropic.claude-sonnet-4-5-20250929-v1:0" ], "Condition": { "StringEquals": { "aws:RequestedRegion": "unspecified", "bedrock:InferenceProfileArn": "arn:aws:bedrock:us-east-1:123456789012:inference-profile/global.anthropic.claude-sonnet-4-5-20250929-v1:0" } } } ]}Critical: The third statement uses a global foundation model ARN with no region or account specified (
arn:aws:bedrock:::foundation-model/* ). This is intentional and required for cross-region routing functionality.Understanding the 3-Part Policy Structure
- Part 1: Grants access to the regional inference profile in your requesting region (us-east-1 in example)
- Part 2: Provides access to the regional foundation model resource with condition checking
- Part 3: Grants access to the global foundation model resource, enabling cross-region routing with
"aws:RequestedRegion": "unspecified"
IAM Policy to Block Global Cross-Region Inference
If you need to explicitly prevent the use of global cross-region inference while allowing geographic profiles, use this deny policy:
IAM Policy: Deny Global Cross-Region Inference
{ "Version": "2012-10-17", "Statement": [ { "Sid": "DenyGlobalCrossRegionInference", "Effect": "Deny", "Action": [ "bedrock:InvokeModel*" ], "Resource": "*", "Condition": { "StringEquals": { "aws:RequestedRegion": "unspecified" } } } ]}How it works: This policy denies any Bedrock invocation where
aws:RequestedRegion equals "unspecified" , which is the indicator for global cross-region routing. Geographic cross-region inference will still work because it uses specific region values. [3] Service Control Policies (SCPs)
Organization-Level Control: SCPs are applied at the AWS Organizations level and affect all accounts within the organization. Test thoroughly before deploying to production.
SCP to Allow Global Cross-Region Inference
If your organization uses SCPs to restrict AWS regions, you must update them to allow global cross-region inference. Add
"unspecified" to your allowed regions list: [2] SCP: Allow Global Cross-Region Inference
{ "Version": "2012-10-17", "Statement": [ { "Sid": "DenyAllOutsideApprovedRegions", "Effect": "Deny", "Action": "*", "Resource": "*", "Condition": { "StringNotEquals": { "aws:RequestedRegion": [ "us-east-1", "us-east-2", "us-west-2", "unspecified" ] } } } ]}Key Point: The
"unspecified" value is specific to Amazon Bedrock global cross-region inference and ensures requests can be routed to all supported AWS commercial regions while maintaining other regional restrictions.SCP to Block Global Cross-Region Inference
Organizations with strict data residency requirements can explicitly disable global cross-region inference using this SCP: [2]
SCP: Block Global Cross-Region Inference
{ "Version": "2012-10-17", "Statement": [ { "Sid": "DenyGlobalCrossRegionInference", "Effect": "Deny", "Action": "bedrock:*", "Resource": "*", "Condition": { "StringEquals": { "aws:RequestedRegion": "unspecified" }, "ArnLike": { "bedrock:InferenceProfileArn": "arn:aws:bedrock:*:*:inference-profile/global.*" } } } ]}How it works:
- Denies all Bedrock actions when
aws:RequestedRegionis"unspecified"
- AND when the inference profile ARN matches the
global.*pattern
- Geographic cross-region inference remains functional
AWS Control Tower Implementation
Warning: Manually editing SCPs managed by AWS Control Tower is strongly discouraged as it can cause drift. Use Control Tower's mechanisms to manage these exceptions.
For organizations using AWS Control Tower, implement cross-region inference policies using one of these approaches:
- Extend existing region-deny controls - Add
"unspecified"to allowed regions
- Enable denied regions with custom SCPs - Create conditional blocking policies
- Use Customizations for AWS Control Tower (CfCT) - Deploy custom SCPs as infrastructure as code
Detailed Guide: For step-by-step implementation with Control Tower, see the AWS blog post: Enable Amazon Bedrock cross-Region inference in multi-account environments [4]
Step-by-Step Implementation
Implementing Geographic Cross-Region Inference
- Create IAM PolicyNavigate to IAM Console → Policies → Create Policy. Use the geographic cross-region IAM policy template provided above, replacing:
-
111122223333with your AWS account ID
- Region codes with your target geography (us-*, eu-*, ap-*)
- Model ID with your chosen foundation model
- Attach Policy to IAM RoleNavigate to IAM Console → Roles → Select your application role → Attach policies → Select your newly created policy
- Request Model AccessIn Amazon Bedrock Console → Model access → Request access to the foundation model in your source region
- Update Application CodeModify your application to use the geographic inference profile:Python Example: US Geographic Profile__PRE_PLACEHOLDER_6__
- Test and ValidateRun test inference requests and verify:
- Requests complete successfully
- Latency meets requirements
- Costs are tracked correctly in billing
Implementing Global Cross-Region Inference
- Review Compliance RequirementsEnsure your organization allows data processing in any AWS commercial region. Consult with:
- Legal/Compliance team
- Security team
- Data governance team
- Create 3-Part IAM PolicyUse the complete 3-part IAM policy template provided above. Replace:Critical: Ensure the third statement includes the global FM ARN with no region/account:
arn:aws:bedrock:::foundation-model/*
-
123456789012with your AWS account ID
-
us-east-1with your source region
- Model ID with your chosen foundation model
- **Update Service Control Policies (if applicable)**If your organization uses SCPs to restrict regions:
- Add
"unspecified"to allowed regions list
- Test in non-production account first
- Document the change for audit purposes
- Attach Policy to IAM RoleNavigate to IAM Console → Roles → Select your application role → Attach the 3-part policy
- Request Model AccessIn Amazon Bedrock Console → Model access → Request access to the foundation model in your source region
- Update Application CodeModify your application to use the global inference profile:Python Example: Global Profile__PRE_PLACEHOLDER_7__
- Monitor and OptimizeSet up monitoring for:
- Request latency (CloudWatch metrics)
- Cost tracking (Cost Allocation Tags)
- Error rates and throttling
- Token usage patterns
Real-World Use Cases with IAM Examples
Use Case 1: EU Healthcare Provider (Geographic)
Scenario: Processing patient medical records with AI-powered diagnostics
Requirements:
- GDPR compliance mandatory
- Patient data must remain in EU
- High accuracy and reliability needed
Recommendation: Geographic Cross-Region Inference (EU)
IAM Policy Implementation:
IAM Policy for EU Healthcare
{ "Version": "2012-10-17", "Statement": [ { "Sid": "AllowEUInferenceProfile", "Effect": "Allow", "Action": "bedrock:InvokeModel*", "Resource": [ "arn:aws:bedrock:eu-central-1:111122223333:inference-profile/eu.anthropic.claude-3-5-sonnet-20241022-v2:0" ] }, { "Sid": "AllowEURegionModels", "Effect": "Allow", "Action": "bedrock:InvokeModel*", "Resource": [ "arn:aws:bedrock:eu-central-1::foundation-model/anthropic.claude-3-5-sonnet-20241022-v2:0", "arn:aws:bedrock:eu-west-1::foundation-model/anthropic.claude-3-5-sonnet-20241022-v2:0" ], "Condition": { "StringLike": { "bedrock:InferenceProfileArn": "arn:aws:bedrock:eu-central-1:111122223333:inference-profile/eu.*" } } } ]}Rationale: Data residency requirements mandate EU-only processing. Geographic inference provides compliance while offering improved throughput.
Use Case 2: Global E-Commerce Platform (Global)
Scenario: AI-powered product recommendations for worldwide customer base
Requirements:
- High-volume inference requests
- Cost optimization important
- No data residency restrictions
- Global user distribution
Recommendation: Global Cross-Region Inference
Implementation Code:
Python: Global E-Commerce Implementation
import boto3import json
bedrock = boto3.client('bedrock-runtime', region_name='us-east-1')model_id = "global.anthropic.claude-sonnet-4-5-20250929-v1:0"
def get_product_recommendations(user_history, preferences): prompt = f"""Based on user purchase history and preferences, recommend 5 products. History: {user_history}, Preferences: {preferences}""" response = bedrock.converse( messages=[{"role": "user", "content": [{"text": prompt}]}], modelId=model_id ) return response['output']['message']['content'][0]['text']
# Example usagerecommendations = get_product_recommendations( user_history="electronics, books", preferences="tech gadgets")print(recommendations)Rationale: No compliance restrictions allow for global routing. The 10% cost savings and maximum throughput align with business goals for high-volume application.
Troubleshooting & Best Practices
Common IAM Policy Issues
Issue 1: Access Denied Error
Symptom:
AccessDeniedException: User is not authorized to perform: bedrock:InvokeModel Solution:
- Verify all three parts of the IAM policy are present (for global inference)
- Check that account ID and region match your configuration
- Ensure the global FM ARN has no region/account specified
- Confirm the IAM role is attached to your application/user
Issue 2: SCP Blocking Global Inference
Symptom: Requests fail with region restriction errors
Solution:
- Add
"unspecified"to your SCP's allowed regions list
- Verify SCP changes have propagated (can take several minutes)
- Test in a non-production account first
Issue 3: Model Not Available
Symptom:
ValidationException: The model is not available Solution:
- Request model access in Amazon Bedrock Console
- Wait for access approval (usually instant for most models)
- Verify you're using the correct model ID format
Security Best Practices
1. Principle of Least Privilege
- Grant only necessary permissions
- Use specific resource ARNs instead of wildcards when possible
- Restrict to specific inference profiles rather than all profiles
2. Use Condition Keys
- Leverage
bedrock:InferenceProfileArnto restrict model access
- Use
aws:RequestedRegionfor geographic controls
- Implement
aws:SourceAccountfor cross-account scenarios
3. Regular Audits
- Review IAM policies quarterly
- Monitor CloudTrail logs for unauthorized access attempts
- Use AWS Access Analyzer to identify overly permissive policies
4. Cost Management
- Implement cost allocation tags on inference profiles
- Set up AWS Budgets alerts for Bedrock spending
- Monitor token usage patterns in CloudWatch
- Review Cost Explorer regularly for optimization opportunities
Quota Management
When using global cross-region inference, quotas are managed globally across 20+ supported source regions. [2]
Requesting Quota Increases
- Sign in to the Service Quotas console in your AWS account
- Navigate to AWS services → Amazon Bedrock
- Search for global cross-region quotas (e.g., "Global cross-Region model inference tokens per minute")
- Select the quota → Request increase at account level
- Enter desired quota value → Submit request
Burndown Rate Consideration: Some models have a 5x burndown rate for output tokens:
- Anthropic Claude Opus 4
- Anthropic Claude Sonnet 4.5
- Anthropic Claude Sonnet 4
- Anthropic Claude 3.7 Sonnet
Formula:
Input tokens + Cache write tokens + (Output tokens × Burndown rate) For other models, burndown rate is 1:1.
Monitoring and Observability
CloudWatch Metrics to Monitor
- Invocations: Total number of model invocations
- InputTokens: Number of input tokens processed
- OutputTokens: Number of output tokens generated
- InvocationLatency: Time taken for inference requests
- InvocationClientErrors: 4xx errors (permissions, validation)
- InvocationServerErrors: 5xx errors (service issues)
Setting Up Alarms
CloudWatch Alarm Example (AWS CLI)
aws cloudwatch put-metric-alarm \ --alarm-name bedrock-high-latency \ --alarm-description "Alert when Bedrock latency exceeds threshold" \ --metric-name InvocationLatency \ --namespace AWS/Bedrock \ --statistic Average \ --period 300 \ --threshold 5000 \ --comparison-operator GreaterThanThreshold \ --evaluation-periods 2Testing Checklist
Before deploying to production, verify:
Test Item | Expected Result | Status |
|---|---|---|
IAM policy attached correctly | No access denied errors | ☐ |
Model access granted | Successful inference requests | ☐ |
SCP allows cross-region routing | No region restriction errors | ☐ |
Latency within acceptable range | < 5 seconds for typical requests | ☐ |
Cost tracking configured | Tags visible in Cost Explorer | ☐ |
CloudWatch alarms set up | Alerts trigger on test conditions | ☐ |
Error handling implemented | Graceful degradation on failures | ☐ |
Quick Reference: Policy Templates
Template 1: Basic Inference Profile Access (All Types)
Use when: Starting with Bedrock inference profiles
Copy-Paste Ready
{ "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": ["bedrock:InvokeModel*", "bedrock:CreateInferenceProfile"], "Resource": [ "arn:aws:bedrock:*::foundation-model/*", "arn:aws:bedrock:*:*:inference-profile/*", "arn:aws:bedrock:*:*:application-inference-profile/*" ] }, { "Effect": "Allow", "Action": [ "bedrock:GetInferenceProfile", "bedrock:ListInferenceProfiles", "bedrock:DeleteInferenceProfile", "bedrock:TagResource", "bedrock:UntagResource", "bedrock:ListTagsForResource" ], "Resource": [ "arn:aws:bedrock:*:*:inference-profile/*", "arn:aws:bedrock:*:*:application-inference-profile/*" ] } ]}Template 2: Geographic Cross-Region (Customizable)
Use when: Need regional data residency compliance
Replace:
REGION , ACCOUNT_ID , MODEL_ID Copy-Paste Ready
{ "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": "bedrock:InvokeModel*", "Resource": "arn:aws:bedrock:REGION:ACCOUNT_ID:inference-profile/GEOGRAPHY.MODEL_ID" }, { "Effect": "Allow", "Action": "bedrock:InvokeModel*", "Resource": [ "arn:aws:bedrock:REGION1::foundation-model/MODEL_ID", "arn:aws:bedrock:REGION2::foundation-model/MODEL_ID" ], "Condition": { "StringLike": { "bedrock:InferenceProfileArn": "arn:aws:bedrock:REGION:ACCOUNT_ID:inference-profile/GEOGRAPHY.*" } } } ]}Template 3: Global Cross-Region (3-Part)
Use when: Need maximum throughput and cost savings
Replace:
SOURCE_REGION , ACCOUNT_ID , MODEL_ID Copy-Paste Ready
{ "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": "bedrock:InvokeModel", "Resource": "arn:aws:bedrock:SOURCE_REGION:ACCOUNT_ID:inference-profile/global.MODEL_ID", "Condition": {"StringEquals": {"aws:RequestedRegion": "SOURCE_REGION"}} }, { "Effect": "Allow", "Action": "bedrock:InvokeModel", "Resource": "arn:aws:bedrock:SOURCE_REGION::foundation-model/MODEL_ID", "Condition": { "StringEquals": { "aws:RequestedRegion": "SOURCE_REGION", "bedrock:InferenceProfileArn": "arn:aws:bedrock:SOURCE_REGION:ACCOUNT_ID:inference-profile/global.MODEL_ID" } } }, { "Effect": "Allow", "Action": "bedrock:InvokeModel", "Resource": "arn:aws:bedrock:::foundation-model/MODEL_ID", "Condition": { "StringEquals": { "aws:RequestedRegion": "unspecified", "bedrock:InferenceProfileArn": "arn:aws:bedrock:SOURCE_REGION:ACCOUNT_ID:inference-profile/global.MODEL_ID" } } } ]}Template 4: SCP to Allow Global Inference
Use when: Organization uses region restrictions
Copy-Paste Ready
{ "Version": "2012-10-17", "Statement": [{ "Effect": "Deny", "Action": "*", "Resource": "*", "Condition": { "StringNotEquals": { "aws:RequestedRegion": [ "us-east-1", "us-west-2", "unspecified" ] } } }]}Template 5: SCP to Block Global Inference
Use when: Strict data residency requirements
Copy-Paste Ready
{ "Version": "2012-10-17", "Statement": [{ "Effect": "Deny", "Action": "bedrock:*", "Resource": "*", "Condition": { "StringEquals": {"aws:RequestedRegion": "unspecified"}, "ArnLike": {"bedrock:InferenceProfileArn": "arn:aws:bedrock:*:*:inference-profile/global.*"} } }]}Additional Resources
AWS Documentation
AWS Blogs
Community Resources
AWS Support
For technical questions or implementation assistance:
- Contact AWS Support through your support plan
- Reach out to your AWS account team
- Post questions on AWS re:Post community
References
- AWS Documentation - Cross-Region Inference Amazon Web Services. "Increase throughput with cross-Region inference." https://docs.aws.amazon.com/bedrock/latest/userguide/cross-region-inference.html Accessed: January 2026
- AWS Documentation - Global Cross-Region Inference Amazon Web Services. "Global cross-Region inference - Amazon Bedrock." https://docs.aws.amazon.com/bedrock/latest/userguide/global-cross-region-inference.html Accessed: January 2026
- AWS Documentation - Prerequisites for Inference Profiles Amazon Web Services. "Prerequisites for inference profiles - Amazon Bedrock." https://docs.aws.amazon.com/bedrock/latest/userguide/inference-profiles-prereq.html Accessed: January 2026
- AWS Blog - Multi-Account Cross-Region Inference Amazon Web Services. "Enable Amazon Bedrock cross-Region inference in multi-account environments." https://aws.amazon.com/blogs/machine-learning/enable-amazon-bedrock-cross-region-inference-in-multi-account-environments/ Published: 2025
- AWS re:Post - Bedrock Cross-Region Inference Billing Amazon Web Services. "Bedrock - Cross Region Inference - Billing." https://repost.aws/questions/QU-eFXG-J4RnKKBOLLCJJ4Rg/bedrock-cross-region-inference-billing Published: January 2026
- AWS Blog - Cost Optimization for Amazon Bedrock Amazon Web Services. "Optimizing cost for using foundational models with Amazon Bedrock." https://aws.amazon.com/blogs/aws-cloud-financial-management/optimizing-cost-for-using-foundational-models-with-amazon-bedrock/ Published: April 2025
Enjoyed reading this content? Let the author know!
Your likes, comments, shares, and saves help creators reach more builders.
Loading recommendations
Loading article