AIP-C01 Enterprise Integration Architectures: Legacy Connectivity, Secure FM Access, Hybrid Routing and GenAI Gateways

Task 2.3 is about connecting foundation model (FM) capabilities to the systems an enterprise already runs, securely and repeatably. It has five skills: connecting to legacy and on-premises systems, adding GenAI features to existing applications, controlling who can reach models and data, meeting data-residency and edge requirements, and releasing GenAI components through CI/CD pipelines and a central GenAI gateway. Most questions describe a working enterprise system and ask which integration design meets every stated constraint.

Neighbouring tasks are only context here: asynchronous buffering of long model calls and provider abstraction belong to Domain 1, streaming and retry APIs to Task 2.4, knowledge-base access filtering to Task 1.4, and guardrail content policies to Task 3.1.

A GenAI workflow calls an existing HTTP system with a managed caller that holds the credentials for it: an AWS Step Functions HTTP Task or an Amazon EventBridge API destination. Both use an EventBridge connection, which stores the authorization (Basic, OAuth client credentials or API key) in AWS Secrets Manager, so no secret lives in code or in the workflow definition. A connection can also reach a private API: it references a VPC Lattice resource configuration, and on-premises APIs are reachable when that VPC has a route to them over AWS Direct Connect or Site-to-Site VPN, so traffic never crosses the public internet.

Three details decide many designs:

• Slow backends. Any backend slower than 5 seconds fails every API destination call, while an HTTP Task waits up to 60 seconds. A backend slower than that, or a private API with an internal domain name, a private certificate authority or mutual TLS, needs a Lambda function (in the VPC, reading its token from Secrets Manager): for private APIs the HTTP Task supports only public domain names with publicly trusted certificates.
• Partner rate limits. When a burst of generated content would exceed what a partner API accepts, cap the API destination's invocations per second at what the partner allows. EventBridge retries 429 and 5xx responses, but a rate far below the arrival rate builds a backlog that can outlast the retry window, so give the target a dead-letter queue so nothing is lost. Lambda reserved concurrency limits parallel executions, not requests per second, so it does not express a per-second limit.
• Long human or batch steps. When a legacy system accepts a job, finishes it hours later and can call a URL back, use the callback pattern: a task with .waitForTaskToken sends the task token with the job, and a callback endpoint (for example API Gateway and Lambda) calls SendTaskSuccess or SendTaskFailure. The workflow resumes the moment the callback arrives, with no polling of a rate-limited status endpoint. Callbacks need a Standard workflow: Express workflows run for at most 5 minutes and do not support .waitForTaskToken. An HTTP Task is synchronous, so it cannot wait hours for a result.

Event-driven integration decouples a GenAI producer from its consumers: the producer publishes each result once and never knows who reads it. On AWS the default building block is a custom EventBridge event bus, with one rule per consumer. Adding a consumer means adding a rule, never changing the producer.

Useful EventBridge patterns for GenAI enhancements:

• Filter before you pay. An event pattern can match fields inside detail, including whether a field exists ({"detail": {"escalationFlag": [{"exists": true}]}}), so the rule invokes the model-calling target only for the events that need it. An input transformer changes the payload, not which events match, and detail-type is a separate top-level attribute. Lambda filter criteria exist only for poll-based event source mappings (for example SQS, Kinesis, DynamoDB Streams, Amazon MSK or Amazon MQ), not for EventBridge's push invocations.
• SaaS events without polling. When a SaaS product is an EventBridge partner event source, associate it with a partner event bus in your account; rules on the default bus do not see partner events. A rule on that bus can start a workflow directly, replacing scheduled polling or a webhook receiver.
• Remove glue functions. A rule can start a Step Functions workflow that calls bedrock:InvokeModel and DynamoDB PutItem through optimized service integrations. A Retry block on the task (for example on Bedrock.ThrottlingException) replaces hand-written retry code. An EventBridge target's retry policy covers only the delivery of the event to the target, and API destinations do not sign requests with SigV4, so they cannot call AWS APIs such as Bedrock.
• Cross-account delivery. To deliver events to a bus in another account with no forwarding code, add a rule on the sending bus whose target is the other bus's ARN, and allow events:PutEvents from the sending account or organization in the receiving bus's resource policy. A rule on the receiving bus cannot see another bus's events.
• Legacy brokers. When an on-premises application publishes with JMS to ActiveMQ and its code cannot change, migrate the broker to Amazon MQ for ActiveMQ (managed, same protocols) and connect its queue to a Step Functions workflow with an EventBridge pipe, a point-to-point integration that supports Amazon MQ as a source and adds optional filtering and enrichment. Pointing a JMS client at SQS or SNS would need protocol changes, and polling an on-premises broker keeps both the broker and custom code.

Keeping a GenAI application in step with a system of record needs three things: change capture from the source, the right ordering when changes are processed, and write-backs that never destroy newer data.

• Change data capture. AWS Database Migration Service (DMS) with a full load plus ongoing replication task reads the source database's transaction logs and applies inserts, updates and deletes to a target such as Amazon DynamoDB, usually within seconds. It needs no triggers or application changes, which matters when another team owns the source. Scheduled copies (AWS Glue jobs, hourly full loads, nightly exports) always leave a staleness window.
• Ordered, parallel processing. When several changes to the same entity arrive in a burst and each one regenerates an AI output, process them with an SQS FIFO queue whose message group ID is the entity ID (for example the account ID). FIFO delivers messages in order within each group, and the Lambda event source mapping processes different groups in parallel. One shared group serializes everything; a standard queue never guarantees order, whatever its concurrency. The message deduplication ID is a different setting: it suppresses messages with the same ID within a 5-minute interval, so putting the entity ID there would silently drop real changes.
• Safe write-back. An FM call takes seconds, and people may edit the same record meanwhile. Use optimistic locking: keep a version attribute that every writer increments, and make the AI write-back a DynamoDB conditional update on the version it read. If the record changed, the write fails and the service can re-read or discard its suggestion. A condition that the key exists does not detect edits, a transaction cannot span a long external call, and a strongly consistent read only guarantees freshness at the moment of reading.

The usual way to add a GenAI feature to an existing microservice API is a new Amazon API Gateway route whose Lambda integration calls Amazon Bedrock, placed beside the existing routes so clients keep the same API. The surrounding API Gateway features decide who can call it and what reaches the model.

Lambda webhook handlers receive events that another system pushes, and webhook senders apply their own response timeout and retry when it passes. Three rules make a handler reliable:

1. Acknowledge fast, process later. Validate the request, put it on an SQS queue, return 2xx, and let a queue consumer call Bedrock. A model call inside the request path outlasts the sender's timeout and causes retries and duplicate outputs; raising the Lambda or API Gateway timeout cannot change the sender's patience, and streaming does not shorten the time to a complete result.
2. Verify the signature over the raw body. An HMAC is computed over exact bytes. Parsing and re-serializing JSON changes spacing, key order, escaping or number formatting, so genuine requests fail verification. Compute the HMAC over the body exactly as received (with Lambda proxy integration, the body string, base64-decoded first when isBase64Encoded is true) and reject forgeries before any model call. API Gateway request validators check presence and shape, not signatures.
3. Make processing idempotent. Senders may resend the same delivery long after the first attempt. Record each delivery ID in DynamoDB with a conditional write (attribute_not_exists) and skip events whose write fails. This works whenever the retry arrives and keeps processing parallel. SQS FIFO deduplication only covers 5 minutes, a single message group removes parallelism, and the queue's visibility timeout addresses SQS redelivery, not sender retries.

Enterprise users should reach GenAI features with their existing corporate identity, never with an IAM user per person. Which AWS service does the federating depends on who calls Bedrock.

Role-based and attribute-based access. When many users federate into one shared role, role permissions cannot tell them apart. Pass an attribute such as department as a SAML session tag (identity pools can also map token claims to principal tags) and reference it in policies, for example an S3 resource of arn:aws:s3:::bucket/${aws:PrincipalTag/department}/*. Each session then reaches only its own prefix, and a new department needs only the attribute in the IdP, not another role, bucket statement or access point.

Model access across an organization. In commercial Regions most serverless Bedrock models are enabled on first invocation: Bedrock starts the subscription automatically the first time a model is called, so developers can use a newly released model without any request. The Model access page applies to AWS GovCloud (US), and denying aws-marketplace:Subscribe does not stop a first invocation. The preventive control is a deny: an SCP that denies the Bedrock invoke actions with NotResource listing the approved model (and inference profile) ARNs blocks every other model in every account, including models added later.

Least-privilege FM access means granting only the Bedrock actions the code actually performs, on the exact model or profile ARNs it uses, with short-lived credentials.

• Actions behind the APIs. Bedrock has no separate IAM actions for the Converse APIs: Converse is authorized by bedrock:InvokeModel and ConverseStream by bedrock:InvokeModelWithResponseStream. Switching a function to streaming therefore needs the streaming action on the same model ARN; a wildcard resource would also work but grants more than needed.
• Cross-Region inference profiles. A profile can serve a request from any Region in its group, and IAM checks the foundation-model ARN in the Region that serves it. A policy naming the profile and only the source-Region model fails intermittently (more often at peak, when more traffic is routed away). Allow the profile ARN and the foundation-model ARN in every Region of the profile, and add the bedrock:InferenceProfileArn condition so those model permissions apply only through that profile. Throttling returns a throttling error, not an access-denied error.
• Bedrock API keys. Some tools can only send a bearer token. A short-term API key is generated from an IAM principal's session, inherits its permissions and expires with the session, at most 12 hours; AWS recommends it for production. A long-term key is an IAM service-specific credential attached to an IAM user and is meant for exploration. To stop every long-term key at once, deny bedrock:CallWithBearerToken when bedrock:bearerTokenType is LONG_TERM (for example in an SCP). Denying iam:CreateServiceSpecificCredential only prevents new keys; existing keys keep working.
• No long-lived secrets on clients. Prefer roles (Lambda execution roles, CodeBuild service roles, identity-pool roles) whose temporary credentials rotate automatically over any key distributed to laptops or builds.

Cross-environment GenAI solutions keep data where regulations or latency require, and route only permitted traffic privately to Amazon Bedrock in a Region. There are three building blocks: private routing from on premises, AWS Outposts for on-site data, and AWS Wavelength for 5G edge clients.

Private routing from on premises

• Bedrock publishes interface VPC endpoints (AWS PrivateLink) for its APIs, for example bedrock, bedrock-runtime, bedrock-agent and bedrock-agent-runtime. The endpoint's network interfaces have private IP addresses, so data-center clients connected over a Direct Connect private virtual interface or Site-to-Site VPN call Bedrock without touching a public endpoint. Bedrock has no gateway endpoint (those exist only for S3 and DynamoDB); a public virtual interface or a NAT gateway both end at the public endpoint.
• Private DNS on the endpoint creates a private hosted zone that overrides the public service name only for resolvers in the VPC. On-premises hosts ask their own DNS servers, which still return public addresses. Create a Route 53 Resolver inbound endpoint and forward the Bedrock domain to it from the on-premises DNS servers; unchanged SDK default endpoints then resolve to the private IPs. (An outbound endpoint forwards from the VPC to on premises, the opposite direction.)
• Endpoint policies. The default endpoint policy allows every action on every resource for every principal. To make the endpoint a control point, replace it with a policy that allows only the approved model ARNs and adds a condition such as aws:PrincipalAccount (or aws:PrincipalOrgID). Security groups and DNS settings only decide which hosts can reach the endpoint, and an SCP cannot govern principals from outside the organization.
• Endpoint-only credentials. An endpoint policy cannot stop the same credentials being used on the public endpoint from elsewhere. To refuse calls that bypass the endpoint, add a deny on the role for the Bedrock invoke actions when aws:SourceVpce is not the endpoint's ID (or aws:SourceVpc is not the VPC). aws:SourceIp does not work for endpoint traffic, which carries private addressing.

AWS Outposts for in-country and on-site data

Outposts extends a Region's EC2, EBS, S3 on Outposts, Amazon RDS, Amazon ECS and Amazon EKS to a customer site, connected to its parent Region by a service link. Amazon Bedrock and SageMaker AI hosting do not run on Outposts, so a private endpoint changes the network path but not where inference happens. Two compliant patterns follow:

• De-identify locally. Keep the application and identifiable data on the Outpost, remove identifiers there, and let only the anonymized text travel to the Bedrock Region the Outpost is homed to, when the rules allow de-identified data to leave. Knowledge bases, cross-Region inference profiles and Bedrock calls with raw text would all move identifiable content into Regions.
• Self-host an open-weight model. When nothing may leave the site, run an approved open-weight model on GPU-backed EC2 instances (such as G4dn) or EKS nodes on the Outposts rack, operated with familiar AWS APIs. Bedrock Custom Model Import and SageMaker AI endpoints still run in the Region.

AWS Wavelength for 5G edge inference

Wavelength Zones are AWS infrastructure embedded in a telecommunications carrier's 5G network, reached through a carrier gateway, and they offer GPU instance types (for example g4dn) suitable for small models. Devices on that carrier in that metro reach them without traversing the internet, which gives the lowest latency for mobile clients. Local Zones are metro-close but outside the carrier network, Outposts serves customer premises, and CloudFront Functions cannot run models. VPC endpoints cannot be created in a Wavelength Zone: put the Bedrock interface endpoint in a regular (non-Wavelength) subnet of the same VPC, and instances in the carrier-zone subnet reach it to reach Bedrock in the parent Region privately.

A GenAI CI/CD pipeline treats prompts, guardrails, model choices and agent configurations as releasable artifacts: AWS CodePipeline runs CodeBuild evaluation and security gates before deployment, and deployment strategies roll a bad release back automatically.

• Score, don't string-match. FM output varies in wording even when it is equally correct, so exact comparisons fail randomly and teams learn to skip them (temperature 0 and retries do not fix this). A CodeBuild evaluation stage runs a fixed test set, grades every output against a reference answer (LLM-as-a-judge or semantic similarity), and fails the build if the overall result falls under a fixed bar or regresses from the previous run.
• Security gates before deploy. The CodePipeline InspectorScan action scans a container image in Amazon ECR (ECR image mode) or source code, produces an SBOM-based vulnerability report, and fails the action when findings exceed its critical, high, medium or low thresholds. AWS CloudFormation Guard run in CodeBuild checks templates against policy rules, for example rejecting bedrock:InvokeModel on Resource: "*". Inspector repository scanning, GuardDuty runtime monitoring and AWS Config rules are valuable detective controls, but they act on what is already pushed or running and cannot stop a release.
• Pin versions through the pipeline. A prompt referenced by its ARN without a version, or a guardrail passed as version DRAFT, follows the working draft, so a console edit reaches production immediately. Create a numbered prompt version and guardrail version in the pipeline after the evaluation stage (CreatePromptVersion, CreateGuardrailVersion or the matching CloudFormation resources) and reference those versions.

Rollback support comes in three forms:

A GenAI gateway is a centralized abstraction layer, typically Amazon API Gateway in front of a Lambda function that calls Bedrock, that applies shared controls once for every consuming team: authentication, guardrails, prompt and response logging, quotas, routing and metering. Its controls hold only if consumers cannot go around it, so the gateway's role keeps Bedrock invoke permissions while team roles lose them (for example with an SCP on the team accounts). A shared SDK wrapper or per-account settings depend on every team's cooperation, and an SCP that only requires a guardrail identifier leaves prompt and response retention scattered.

When each team calls Bedrock with its own IAM role, Bedrock's IAM principal cost allocation (tags on the calling role or user) is the simpler way to split spend; application inference profiles are the answer when the principal is shared.