Enforce zero data retention on Amazon Bedrock with Bedrock Projects and service control policies

This article explains how to enforce zero data retention on Amazon Bedrock using Bedrock Projects and service control policies to prevent data sharing with third-party model providers.

• Amazon Bedrock data retention modes control whether prompts and outputs are retained after inference, with modes including none, default, inherit, and provider_data_share.
• Data retention mode acts as a ceiling, not a floor—models supporting zero retention operate that way regardless of account-level settings.
• Amazon Bedrock Projects enable workload isolation on the bedrock-mantle endpoint, allowing different projects within the same account to have different retention policies.
• Service control policies (SCPs) provide organization-wide enforcement by blocking any attempt to set data retention to modes other than none.
• SCPs apply globally across all regions and override all principals, including account administrators and root users.
• Data retention mode is evaluated in the source region of requests, though retained data may reside in the destination region.
• Verification tools include AWS CLI commands, bedrock-mantle API calls, and the Amazon Bedrock console to check retention modes and confirm SCP enforcement.

Organizations can combine projects and SCPs for defense-in-depth data governance, ensuring compliance with data retention requirements while maintaining flexibility for different workloads.