A SaaS company hosts its app in three workload accounts and must add support chat using Amazon Bedrock without storing foundation model data locally and while centralizing model access control and logging. Developers need private inference in each workload VPC. Which multi-account generative AI integration pattern meets centralized governance with local inference?
Select an answer to reveal the explanation.
Short Explanation
You'll keep governance simple when you run Bedrock from one shared services account and let each workload VPC connect privately. You get one locked library your teams borrow from, so nothing messy stays local.
Full Explanation
The correct approach works because Bedrock supports centralized model access through cross-account IAM roles and interface VPC endpoints, allowing workload accounts to invoke models governed, logged, and version-controlled in a shared services account without data leaving the private network. Replicating custom models with public endpoints fails by concept because it fragments governance, duplicates model management, and exposes inference to the internet contrary to private VPC requirements. Self-hosted models on EC2 fail by concept because it abandons managed Bedrock guardrails, logging, and model lifecycle for operational burden and loses centralized control. Enabling Bedrock separately in every account fails by concept because decentralized enablement creates inconsistent model versions, policies, and logs despite consolidated billing. Exam caveat: focus on Bedrock cross-account patterns that separate control plane governance from data plane inference. Practical check: confirm CloudTrail in the shared account logs every cross-account InvokeModel call with workload identity and VPC endpoint source.