GuideAdvanced

Genai On Aws Production

Adds Andes Cargo's first generative AI workload: an extractor that kicks in when the inherited deterministic manifest parser can't read free-text input, invoking an Amazon Bedrock model as an escalation path, never as the default. This is the only guide in the ecosystem where no real model invocation runs inside the lab — Bedrock requires a paid account and is only available on LocalStack's Ultimate plan — so it declares the entire infrastructure as real code (`terraform validate`/`plan` genuinely verified, with no LocalStack or AWS account needed), builds Bedrock Guardrails' six policies as HCL, and complements them with its own defense-in-depth layer (a PII scrubber and an output schema validator, both deterministic and tested with `pytest`). It extends the security gate and cost gate the sibling guides already built (least-privilege IAM for `bedrock:InvokeModel`, a new cost policy) and computes per-token cost with its own calculator, since Infracost can't price a volume assumption nobody declared. It applies SLI/SLO vocabulary to AI metrics (escalation rate, guardrail block rate, latency) and closes with a capstone that runs the cheap path end to end and documents, with exact honesty, where the executable stops and the representative begins. It doesn't teach prompt engineering, RAG, agents, or semantic evaluation — that's AI Engineering territory; this guide teaches how to operate, not build, the AI system.