AIP-C01 AWS Certified Generative AI Developer - Professional Study Guide¶

Independent AI-assisted resource — SOURCES + OBJECTIVES CHECKED; HUMAN REVIEW PENDING. Objective coverage, citations, volatility labels, links, and exam-integrity compliance were reviewed on October 28, 2026, including all 98 detailed skills. This is not a guarantee that the guide is error-free or current after that date. See the sources-and-objectives record. The official AIP-C01 exam guide is authoritative.

Study guide at a glance

Start here

Report an issue with AIP-C01

Blueprint checked2026-10-28

Review stateSources + objectives checked — human review pending

Guide-only active reading45 min–1 hr 15 min

Prerequisites: No formal certification prerequisite; AWS targets candidates with two or more years building production applications on AWS or open-source technologies, general AI/ML or data-engineering experience, and one year implementing generative-AI solutions. Practice governed multimodal data, RAG and evaluation, model abstraction, prompts, agents/tools/state, enterprise integration, safety/security, deployment, observability, performance/cost optimization and evidence-driven troubleshooting.

Exam essentialsRead the objective map, key distinctions, and readiness checklist.

Deep understandingWork through every domain, including decisions, failure modes, and related items.

Hands-on labsBegin with Lab 1: Use-case and model decision record — 90–150 minutes, then use the remaining labs to produce evidence you can inspect and explain.

Official objective domains

See the objective map in this guide

The active-reading range uses 90–130 words per minute for technical material. Labs, troubleshooting, note-taking, spaced review, and prerequisite gaps add time; it is not a total preparation promise.

Current baseline: Current standard five-domain AIP-C01 AWS Certified Generative AI Developer - Professional guide; 65 scored plus 10 unscored questions
Upcoming blueprint change: None announced on the official exam guide or certification page as of September 28, 2026. See the deep-review report.
Important freshness boundary: AWS announced standard-exam registration in March 2026 and identified March 31 as the final beta day, with the standard scope refreshed for fast-moving services including Amazon Bedrock AgentCore. Use the current ai-professional-01 guide—not an early beta outline or an unofficial AP1/AIGDP code. Model catalogs, APIs, regions, quotas, pricing, safety features, AgentCore components, Strands, AWS Agent Squad, MCP, and learning products are VERIFY CURRENT.
Official source: AWS Certified Generative AI Developer - Professional exam guide

Current AgentCore context — October 28, 2026¶

AWS released AgentCore Runtime V2 on September 18 in five named regions and documents platformVersion=V2 as the opt-in. Its October AgentCore Gateway update adds Bedrock InvokeModel and InvokeModelWithResponseStream wire-format support for inference targets, translating between Bedrock and OpenAI/Anthropic SDK formats at the aggregate inference endpoint. Treat exact regions, API compatibility, availability, and runtime version as volatile implementation context; the AIP-C01 published five-domain outline remains the exam authority.

How to use this guide¶

AIP-C01 tests whether you can move from a generative-AI proof of concept to a production application: select and abstract models, build governed data and retrieval, implement agents/tools and enterprise integration, layer safety/security, measure quality/cost/latency, and troubleshoot the whole system. AWS explicitly places model development/training, advanced ML techniques, and feature engineering outside the target role, though deployment/lifecycle of customized models and data preparation for FM consumption remain in scope.

AWS targets candidates with two or more years building production applications on AWS or open-source technologies, general AI/ML or data-engineering experience, and one year implementing GenAI solutions. The certification page lists a 180-minute, 75-question, USD 300 exam in English, Japanese, Korean, and Simplified Chinese. The detailed guide identifies 65 scored and 10 unidentified unscored items and a 750 minimum scaled score. Recheck the live certification page before scheduling.

For every GenAI scenario, reason through this system:

Define user/business outcome, unacceptable harm, data rights, latency, scale, availability, budget, and human-oversight need.
Establish an evaluation set and baseline before selecting a model or architecture.
Decide what belongs in prompt/context, retrieval, tool/action, structured deterministic code, or model customization.
Design identity, network, data lineage, privacy, safety, authorization, and evidence across the whole path.
Implement explicit contracts for models, embeddings, chunks, prompts, tools, agent state, output schemas, and fallbacks.
Observe quality, grounding, safety, tool behavior, latency, tokens, cost, and business outcomes; test changes continuously.

About related items: A Related item: callout adds prerequisite, operational, architectural, or adjacent context that makes the current topic easier to understand. It is useful supporting knowledge, not a claim that the item appears verbatim in the published exam objectives.

Objective map¶

Published domain	Weight	Central question
Foundation Model Integration, Data Management, and Compliance	31%	How are model, data, vector/retrieval, and prompt decisions designed as a governed system?
Implementation and Integration	26%	How are agents, tools, models, APIs, workflows, and enterprise systems integrated reliably?
AI Safety, Security, and Governance	20%	How are misuse, sensitive data, authorization, traceability, fairness, and policy controlled in depth?
Operational Efficiency and Optimization for GenAI Applications	12%	How are token/model/vector/tool cost, latency, throughput, quality, and business value optimized together?
Testing, Validation, and Troubleshooting	11%	How is probabilistic system quality measured, released, diagnosed, and improved?

The first three domains are 77% of scored content. Do not study safety or evaluation as an appendix: they constrain the design from the first requirement.

1. Foundation Model Integration, Data Management, and Compliance — 31%¶

The official Domain 1 page covers requirements/architecture, FM selection, input-data pipelines, vector stores, retrieval, and prompt engineering/governance.

Start with a use-case and evaluation contract¶

Define task, users, languages/modalities, knowledge freshness, output format, action authority, latency percentile, traffic/throughput, availability, privacy/residency, safety, explainability, cost per successful outcome, and escalation. A proof of concept should validate a risky hypothesis—not merely show fluent text.

Build a representative evaluation set with normal, rare, ambiguous, adversarial, sensitive, stale, and refusal cases. Record expected facts/evidence, acceptable response ranges, forbidden behavior, tool outcomes, and business metric. Baseline a simple prompt/model and a non-GenAI or deterministic alternative where appropriate. This prevents selecting architecture by demo impression.

Use the AWS Generative AI Lens to review lifecycle decisions across operational excellence, security, reliability, performance, cost, sustainability, and responsible AI. It supports architecture judgment; it is not the exam blueprint.

Select models by measured fit¶

Compare capability/modalities/language, context/output limits, latency, throughput, quality on your set, safety behavior, customization options, tool/structured-output support, regional availability, compliance/data terms, resilience, and price. Larger models can raise quality on complex tasks but also latency/cost; smaller models can route/classify/extract routine work. Use cascading or routing only if the routing error, observability, and fallback are acceptable.

Amazon Bedrock offers managed access to multiple FMs and GenAI building capabilities. SageMaker AI supports customer-managed/custom-model deployment patterns. Abstract the model contract—request/response schema, capabilities, parameters, error normalization, metrics, safety policy, and fallback—without pretending providers are behaviorally interchangeable.

Resilience can include exponential backoff with jitter, timeouts, concurrency/rate limits, circuit breakers, queues for asynchronous work, Cross-Region Inference where supported, provider/model fallback, cached/degraded results, and human escalation. A fallback model must pass safety, data, and quality policy; availability alone is insufficient. Cross-Region inference profiles can be geographic or global. A geographic profile bounds processing to its supported geography, not necessarily the request's source Region. Global routing can process in supported commercial Regions worldwide. Check destination permissions and SCPs, the specific model/profile and data requirements before selecting it. Traffic staying on the AWS network does not mean it stays in one Region. The source-Region CloudTrail event can identify the processing Region through additionalEventData.inferenceRegion.

Model customization options range from prompt/RAG through parameter-efficient adaptation, fine-tuning, or other supported methods. Choose only when evaluation shows the simpler layer cannot meet behavior. Version data, model/base, hyperparameters/adapters, prompt, evaluation, container, endpoint/config, approval, and rollback. The target role deploys/manages customization rather than inventing advanced training algorithms.

Related item: RAG changes the information supplied at inference; customization changes model behavior/weights or adapters. They can complement one another and solve different failure classes.

Govern multimodal input data¶

For text, image, audio, video, or tabular inputs, define source authority/license/consent, owner, classification, lineage, format/size, language, quality, malware/content risk, duplication, update/delete behavior, and retention. Validate schema and content before use. Normalize/segment/transcribe/extract only with traceable transformations; preserve source-to-derived links and deletion propagation.

Model-specific request formats, conversation roles, token/context limits, image/audio constraints, and structured outputs are API contracts. Validate and reject malformed inputs deliberately. Do not silently truncate critical content. Record what was omitted and route oversized work to chunking/summarization/batch workflows according to requirements.

Bedrock Data Automation converts supported document, image, audio and video content into structured information for downstream applications. It is a concrete option for skills 1.3 and 2.5.3. Keep provenance to the original, validate required fields and business rules, and route ambiguous extraction to review. A confidence score or valid JSON is not proof that the extracted invoice total matches the source.

Design vector stores and retrieval as one system¶

An embedding maps content/query into a vector space. Similarity depends on embedding model/version, dimension, preprocessing, language/domain, distance metric, and index. Do not change the embedding model for only new records; either maintain compatible versioned indexes or re-embed deliberately.

Choose OpenSearch vector capabilities, Aurora PostgreSQL/pgvector, Bedrock Knowledge Bases with supported stores, or other services from scale, latency, filtering, hybrid search, operations, tenancy, backup, consistency/freshness, and cost. A vector database is not the document authority. Keep source ID/version, chunk offsets, owner, classification, ACL/tenant attributes, timestamps, and lineage.

Chunking controls retrieval units. Compare fixed-size/overlap, sentence/semantic, document-structure/hierarchical, and modality-specific segmentation. Too small loses context; too large dilutes relevance and consumes tokens. Validate with retrieval metrics and end-to-end answer quality, not a universal chunk size.

RAG flow:

authorize the user and query scope;
normalize/decompose/expand the query only where evaluated;
embed with the matching version;
retrieve with tenant/ACL/metadata filters;
optionally combine keyword/vector results and rerank;
assemble bounded, attributed context;
prompt the FM to use evidence and abstain when insufficient;
validate output/citations and record lineage without leaking sensitive content.

Retrieval freshness needs change detection, reprocessing, re-embedding, upsert/delete, index readiness, reconciliation, and lag monitoring. Event-driven updates improve freshness but need duplicate/order/retry handling; scheduled rebuilds can simplify reconciliation. Test revoked access and deleted source propagation. For a connector-based Bedrock knowledge-base sync, source changes require ingestion; incremental sync processes changed, added and deleted documents. Metadata-only optimization has conditions: non-CSV content, no custom transformation Lambda, and no content change. CSV metadata updates trigger re-ingestion. Confirm ingestion results and query visibility; do not assume an S3 object deletion immediately removes every retrievable copy. Direct-ingestion and managed knowledge-base paths have their own contracts.

Related item: Grounding reduces unsupported claims only when retrieval returns relevant, authorized, current evidence and the generation step actually uses it. RAG does not guarantee factuality.

Version prompts as production artifacts¶

Define system instructions, role/task, constraints, context delimiters, examples, refusal behavior, output schema, tool contract, parameters, and version. Bedrock Prompt Management/Flows or a governed repository can support reuse/approval. Separate trusted instructions from untrusted user/retrieved/tool content; label and delimit each.

Use zero/few-shot examples, decomposition, structured output, self-check/verification, or chained flows only where evaluation supports them. Avoid requiring private hidden reasoning to be exposed. Prompt changes need regression/safety/cost tests, canary release, audit, and rollback just like code.

2. Implementation and Integration — 26%¶

The official Domain 2 page covers agents/tools, model deployment, enterprise integration, FM APIs, and application/development patterns.

Build agents as bounded state machines¶

An agent loop observes a request/state, plans or selects a next step, invokes a tool, observes the result, and continues until a stop condition. Production design specifies:

task scope and success/failure definition;
allowed tools/actions/resources and identity per tool;
typed input/output schemas and validation;
working, session, long-term, and enterprise-record state ownership;
maximum steps, tokens, duration, retries, cost, and recursion;
idempotency/transaction/compensation for side effects;
human approval before sensitive or irreversible actions;
trace, audit, safety filters, and emergency disable.

Bedrock Agents/Flows, AgentCore components, Strands Agents, AWS Agent Squad, Step Functions, Lambda, containers, and custom frameworks can participate according to current capabilities. Names and availability are VERIFY CURRENT. Use the AgentCore overview to connect the names to responsibilities:

Component	Responsibility to understand	Boundary to retain
Runtime	Host and isolate agent/tool execution	Your code, actions and data still need authorization
Gateway	Expose supported APIs/tools through a common access path	Tool discovery is not permission to use every tool
Memory	Persist session or longer-lived context	Ownership, retention, correction and deletion remain explicit
Identity	Manage workload/user-related credentials	Credential possession is not unlimited business authority
Policy	Evaluate tool requests at the gateway	Calls outside that path need their own controls
Observability / Evaluations	Capture execution evidence and assess behavior	A trace or judge score does not prove a correct side effect

This is a learning subset, not a complete component catalog. Separate orchestration from tool authorization: an FM may propose an action, but deterministic code and IAM must validate caller, parameters, policy, resource scope, state, and approval.

MCP standardizes context/tool integration patterns; it does not make a server trustworthy. Authenticate/authorize, validate schemas, allowlist tools, constrain network/filesystem/data, prevent confused deputy and indirect prompt injection, rate-limit, audit, and pin/review implementations. Use Lambda for suitable stateless/lightweight servers and containers for longer-lived or more complex needs according to runtime requirements.

Multi-agent designs add delegation, message/state contracts, loop/deadlock risk, conflicting goals, cost, latency, and evaluation complexity. Use specialized agents only when measured modular benefit exceeds the coordination surface.

Related item: “Autonomous” describes how often the system proceeds without human input, not permission to operate without boundaries, observability, or accountability.

Choose inference/deployment deliberately¶

Bedrock on-demand/serverless invocation, provisioned throughput, batch, Cross-Region Inference and supported latency-optimized modes solve different traffic, latency, availability, and cost needs. SageMaker endpoints or container infrastructure fit supported customized/open models when control is required. Confirm model access, region, quotas, concurrency, payload/context, streaming, pricing, and data behavior.

For self-hosted FMs, own image/model artifacts, accelerator type/memory, loading/sharding, quantization compatibility, batching, autoscaling, health/readiness, endpoint security, patching, observability, failover, and cost. Do not default to self-hosting because unit inference appears cheaper at one utilization point.

Use immutable versions and canary/blue-green traffic with an evaluation gate. Model changes can alter tokenization, output schema, safety, tool calls, and retrieval compatibility even when API code does not change.

Integrate APIs and enterprise workflows¶

Synchronous invocation fits bounded interactive latency; streaming improves perceived latency but requires partial-output safety, cancellation, backpressure, client reconnection, and final-state handling. Asynchronous queues/batch fit long/large/variable work and require correlation, idempotency, status, retry, DLQ, timeout, and result retention.

API Gateway, Lambda, containers, Step Functions, EventBridge, SQS/SNS, AppSync/WebSockets, and SDKs implement standard distributed-system patterns around the FM. Validate request/auth/quota; do not leak provider errors or prompts; normalize model response and usage; implement retry only for retryable failures; set total time/cost budget; and trace each boundary.

Enterprise integration must map system of record, identity/federation, authorization, data classification/residency, network path, schema/contract, synchronization/CDC, latency, failure semantics, human approval, audit, and rollback. Use events for loose coupling where suitable. Never let a generated value update CRM/ERP/ticket/financial systems without deterministic validation and authorization appropriate to impact.

Create a GenAI gateway only if it provides useful centralized model abstraction, authentication, quotas, safety, routing, cost/usage, logging/redaction, and policy. Avoid a bottleneck that erases model-specific capability or becomes a universal data exfiltration point.

Deliver GenAI components with CI/CD¶

Version code, IaC, dependencies, prompt, model/config, embedding/index schema, chunks/transformers, guardrail/policy, tool schemas, evaluation sets, thresholds, dashboards, and runbooks. Build and scan immutable artifacts; deploy to isolated test; run deterministic plus probabilistic evaluation; canary; monitor; promote or roll back.

Kiro is another development-tool entry in the current scope, while Amazon Quick provides workplace research, analytics and automation capabilities. Neither name substitutes for understanding the custom application architecture. Amazon Q Developer can assist code/refactoring/testing, but generated changes require source review, tests, security/licensing checks, and ownership. AI assistance does not replace engineering evidence.

3. AI Safety, Security, and Governance — 20%¶

The official Domain 3 page covers input/output safety, data security/privacy, governance/compliance, and responsible AI.

Use defense in depth for probabilistic behavior¶

Layer	Representative controls
Request	authentication, authorization, rate/quota, size/schema/type, PII/content classification
Prompt/context	trusted-instruction separation, delimiters, ACL-filtered retrieval, context limits, secret removal
Model	approved model/version/parameters, Bedrock Guardrails, provider safety settings, refusal policy
Tool/action	allowlist, typed parameters, least-privilege role, state checks, approval, idempotency, transaction limits
Output	schema validation, citation/evidence verification, PII/toxicity/policy filters, deterministic business rules
Runtime	private endpoints/network, encryption, secrets, logging/redaction, anomaly detection, kill switch
Lifecycle	adversarial evaluation, red team, monitoring, incident response, model/prompt/tool retirement

Prompt injection attempts to make untrusted content override the application's intended control. Treat user input, retrieved documents, websites, tool output, messages, and memory as data—not instructions. Filtering alone is insufficient; enforce authority outside the model. Indirect injection becomes especially dangerous when an agent has tools.

Guardrails can filter denied topics/content, sensitive information, grounding or other supported policy dimensions, but verify current coverage, language/modality, placement, latency, and false positives/negatives. Combine deterministic validation, model-based moderation, grounded evidence, tool boundaries, and humans according to risk.

AgentCore Identity, Policy and Bedrock Guardrails solve different parts of control. Identity manages credentials; Policy checks permitted tool actions and inputs at the gateway; Guardrails evaluates supported content/policy dimensions. Policy supports Cedar and Dogwood, including session-aware conditions such as an approval before an action or a cumulative budget. Review generated policies, test permit and deny cases, and enforce durable transaction limits at the business system too: a session limit alone is not a customer-wide spending limit.

Guardrails documentation excludes reasoning content blocks from its described input/response filtering coverage. Do not assume every captured field is filtered or safe to log. A generated SQL statement also needs parsing/allowlisted operations, caller-bound row access, read-only credentials where appropriate, and resource limits before execution. JSON Schema can validate shape while facts, authorization and query semantics remain wrong.

Protect identity, data, and privacy¶

Map principals and data flow from user through API/orchestrator/model, prompt store, logs/traces, vector store, source system, tools, feedback, and evaluation. Apply least-privilege IAM/resource/key policies, temporary credentials, VPC endpoints/private paths where required, encryption, secret management, tenant isolation, and audit.

Minimize sensitive input. Detect/redact/tokenize/mask PII before model use when possible; prevent it from appearing in prompts, embeddings, logs, caches, feedback, or outputs without a governed need. Define residency, retention, deletion, legal basis/consent, data-owner approval, and third-party model/provider terms. Verify deletion across source, chunks, embeddings, caches, backups, and derived evaluation data.

An embedding can reveal semantic information and should inherit source sensitivity. Metadata filters are part of authorization but not a substitute for identity enforcement. Test cross-tenant queries, index mistakes, cache keys, and tool access.

Make governance executable¶

Maintain an AI system record: owner, intended/prohibited use, users, risk tier, models/providers/versions, data sources/rights/lineage, prompts, retrieval, tools/agency, safeguards, evaluations/thresholds, limitations, regions, retention, monitoring, incidents, and change approvals. Model cards and system cards communicate limitations and evidence; they do not remove operational controls.

Translate policy to automated pre-deploy tests, guardrail/policy configuration, runtime checks, monitoring, periodic review, and exception workflow. Preserve who approved what version based on which evidence. Track sources/citations and decision/tool logs according to privacy policy.

Responsible AI concerns include fairness, explainability/transparency, privacy/security, robustness/safety, controllability, and accountability. Choose metrics and review groups relevant to the harm; one average quality score cannot prove fairness. Human/LLM-as-judge evaluation needs clear rubric, calibration, disagreement handling, privacy, and judge-bias/model awareness.

Related item: Showing internal reasoning text is not reliable explainability and may disclose sensitive information. Prefer source attribution, decision factors, tool/action audit, confidence/uncertainty signals, and documented limitations.

4. Operational Efficiency and Optimization — 12%¶

The official Domain 4 page covers token/resource cost, performance, retrieval/throughput, and holistic GenAI monitoring.

Optimize a quality-constrained objective¶

Track cost per successful/approved task, not merely cost per token. Break down input/output tokens, embedding, vector queries/storage, reranking, guardrails, tool/API calls, agent steps, retries, compute, data transfer, caching, logging, and human review. Relate to quality, safety, latency, completion, escalation, conversion, or labor saved.

Optimization levers include:

route routine work to a smaller evaluated model and escalate complex/low-confidence cases;
shorten instructions/context while preserving requirements and evidence;
improve chunking/filter/reranking so fewer high-value chunks enter context;
cap output and agent steps/tools; stop loops;
cache only when identity/tenant, freshness, prompt/model/policy version, safety, and invalidation are correct;
batch offline work and embedding generation;
select on-demand versus provisioned capacity from measured utilization and latency;
parallelize independent steps while respecting quota/cost and partial failure;
remove redundant judge/model/tool calls.

Bedrock prompt caching includes implicit reuse of eligible prefixes and explicit model/API-specific cache controls. Put reusable static context before changing content where appropriate. Implicit reuse is best effort, so an identical prompt does not guarantee a hit. Check supported model/API, minimum prefix, TTL and measured cache-read/write usage; do not apply one model's limits to all models.

Prompt caching and semantic caching have different invalidation and privacy risks. A semantic cache can return a plausible but unauthorized or stale answer unless the key includes security and version context.

Measure latency and throughput end to end¶

Decompose DNS/network/gateway, queue, orchestration, retrieval, rerank, prompt assembly, time to first token, generation, tool calls, validation, and persistence. Streaming improves perceived response time but not necessarily total time or cost. Measure p50/p95/p99, tokens/second, queue time, concurrency, throttles, retries, error rate, and user abandonment.

Vector performance depends on index/algorithm/parameters, shards/partitions, filters, dimensions, data distribution, refresh, query complexity, cache, and hardware/service capacity. Optimize jointly with recall/relevance; a fast empty or irrelevant result is failure.

Observe behavior, not just infrastructure¶

Create privacy-aware traces connecting request, tenant/use case, prompt/model/parameter version, retrieval IDs/scores, guardrail result, agent/tool steps, token/latency/cost, validation, feedback, and outcome. Redact or sample payloads according to policy.

Monitor availability/errors/throttling, latency, tokens/cost, retrieval relevance/latency, grounding/factuality, refusal, unsafe/PII rates, schema validity, agent completion/steps/tool failure, user feedback, business result, and distribution/drift. CloudWatch, Bedrock invocation logging, X-Ray/OpenTelemetry, application logs, cost tools, and evaluation pipelines each cover part of the picture.

Alert on actionable deviation with owner/runbook, not every model variation. Model, data, prompt, retrieval, traffic, user, and tool changes can all shift outcomes.

5. Testing, Validation, and Troubleshooting — 11%¶

The official Domain 5 page covers multi-perspective evaluation, user feedback, continuous QA, RAG/agent/deployment validation, and system troubleshooting.

Evaluate components and the complete outcome¶

Use a versioned dataset split by use case, language, cohort, difficulty, risk, freshness, and adversarial pattern. Prevent test leakage. Define rubric and thresholds before examining candidate outputs.

Layer	Useful evidence
Retrieval	recall/precision or relevance at k, MRR/nDCG where appropriate, filter/ACL correctness, latency, freshness
Generation	factuality/groundedness, relevance, completeness, instruction following, fluency, citation correctness
Safety	harmful input/output, injection/jailbreak, PII leakage, refusal/helpfulness, tool misuse
Agent	task success, valid tool selection/arguments, steps, loop/timeout, state, side-effect correctness, human escalation
Operations	availability, error/throttle, latency, tokens/cost, retries, cache, throughput
Business/user	acceptance, resolution, conversion, escalation, satisfaction, harm/complaint and human correction

Exact-match/ROUGE-style metrics can help deterministic or summarization cases but miss semantic and factual quality. Embedding/model-based scores can be biased. LLM-as-judge scales qualitative review but needs rubric, judge version, calibration against humans, order/blind controls, and disagreement analysis. Human evaluation needs trained reviewers, privacy, sampling, adjudication, and inter-rater evidence.

Use offline regression before release, shadow/canary/A-B where ethical and safe, and continuous sampled evaluation after release. A model/prompt winner must meet safety and cost/latency constraints; average improvement cannot hide critical cohort regressions.

AgentCore Evaluations assesses instrumented agent behavior and supports built-in or custom evaluators. Choose deterministic checks for exact contracts and calibrated judge/human review for qualitative outcomes. Record the trace, evaluator/version, rubric, dataset, missing results and threshold; an evaluator error should not quietly become a passing score.

The September 8 CI evaluation article is useful selected reading for evaluation gates and authentication tradeoffs. Stored traces measure the captured run, so they do not prove the current PR's behavior. Its live machine-to-machine example intentionally bypasses user-role checks; a passing score therefore cannot validate user authorization. Use scoped machine permissions and separate role-bound positive/negative tests before adapting it. A fixed fixture also does not make an LLM judge deterministic. The linked deployment code was not run for this guide.

Troubleshoot by isolating the layer¶

Reproduce with sanitized request and record all versions/IDs/timestamps.
Validate identity, region, quota, endpoint, API schema, timeout, retry, streaming, and service error.
Check tokenization/context length, truncation, roles, delimiters, prompt variables, parameters, and output schema.
Inspect source ingestion, transformation, chunking, embedding version/dimension, metadata/ACL, index freshness, query, filters, search/rerank results.
Trace agent state, plan/stop, tool choice/arguments, permissions, tool response, idempotency, loops, and human gate.
Evaluate guardrail/moderation/input/output validation and possible false positive/negative.
Compare golden-set quality and operational metrics before/after the change; rollback or route safely.

For poor RAG answers, separate retrieval failure from generation failure. If the correct source is absent, inspect authorization, ingestion, chunk, embedding, query, filter, index, and rank. If present but unused/misquoted, inspect context assembly, prompt/instructions, context position/volume, model, parameters, citations, and output validation.

For inconsistent output, control model/version/parameters, prompt/order, retrieval results, tool outputs, and random sampling; use schema constraints and validation. Do not promise deterministic natural language where the business requirement actually needs deterministic code.

Related item: A golden dataset is a maintained measurement asset, not a frozen truth. Update it through governed review as products, policies, data, users, and risks change, while preserving historical comparability.

Integrated scenarios¶

Scenario 1: Regulated support assistant¶

A support assistant must answer from customer-specific manuals and may draft—but not execute—account changes. Authenticate and tenant-filter every source query, track document rights/version/deletion, use hybrid retrieval/reranking with citations, and refuse insufficient evidence. Redact sensitive inputs/logs, apply guardrails plus deterministic output rules, and keep account-change APIs outside direct model authority; require a human-approved structured request. Evaluate grounding, citation, cross-tenant leakage, injection, PII, refusal/helpfulness, latency, cost, and support resolution before canary release.

Scenario 2: Agentic incident helper¶

An agent summarizes telemetry and proposes remediation. Give read-only tools first, typed/allowlisted parameters, short-lived scoped identities, step/time/token budgets, trace, and a stop/escalation condition. Separate untrusted logs from instructions. For an approved action, use deterministic preconditions, change ticket/human approval, idempotent runbook, blast-radius/rate controls, and post-action verification. Measure correct diagnosis, evidence citation, safe tool choice, time saved, false action, and recovery—not conversational fluency.

Scenario 3: Multimodal claims intake¶

Images/audio/text enter an asynchronous workflow. Validate file/type/size/malware/consent, transcribe/extract with lineage, classify sensitive data, and store protected originals/derived artifacts under retention policy. Route simple cases to a smaller model and complex cases to a capable multimodal model. Use a queue, idempotent state, human review for low confidence/high impact, and a governed CRM write. Evaluate extraction and business correctness by document/cohort, safety/privacy, tool/schema validity, throughput, backlog, tokens/cost, and deletion propagation.

Worked development decisions¶

These original examples use synthetic data and hypothetical prices. Sixteen local arithmetic and policy assertions passed. They do not validate Bedrock, IAM, a deployed agent or model quality.

Separate retrieval precision from recall: A query has four relevant authorized documents. The top three results contain two of them and one irrelevant document. Precision@3 is 2/3; recall@3 is 2/4. Raising k may recover evidence but adds context and possibly irrelevant material. Evaluate answer quality and permissions alongside retrieval metrics.
Budget the whole prompt: With an 8,000-token context, 1,500 reserved output, 1,000 instructions, 500 tool schemas and 1,000 history, only 4,000 remain for retrieved context. Six 800-token chunks require 4,800 before wrappers/citations and exceed the budget. Five fit only before that overhead; reserve overhead or use fewer/smaller selected chunks rather than silent truncation.
Compare cost per success: A baseline makes 1,000 calls at a fictional $0.01 each, with 800 acceptable outcomes: $10/800 = $0.0125 per success. A candidate costs $0.009 per call but produces only 600 acceptable outcomes: $9/600 = $0.015. Lower call cost raised cost per useful outcome, before retries or review.
Enforce more than a per-call cap: A synthetic refund tool requires the caller's tenant to match the order, verified approval, positive integer cents and a per-call maximum of 10,000 cents. Even two separately allowed 8,000-cent refunds exceed a 10,000-cent session budget. Enforce the cumulative check and a durable per-order ledger atomically; resetting a session must not reset the business obligation.
Detect a hidden cohort regression: On 200 cases split 180 common/20 rare, baseline results of 162/180 and 18/20 produce 90% overall. A candidate's 171/180 and 10/20 produce 90.5% overall, but the rare cohort falls from 90% to 50%. An average-only gate wrongly rewards the regression. Define cohort and critical-safety gates before measuring candidates.

Practice labs¶

The eight cloud labs remain proposed; this review ran only synthetic local checks. Use an AWS Builder Lab, organization-approved sandbox, or disposable personal training account. Avoid regulated/production data, set budgets, use least privilege, record resources, and remove billable resources. Model/service access and pricing are VERIFY CURRENT.

Lab 1: Use-case and model decision record — 90–150 minutes¶

Define outcome, risk, data, latency, scale, availability and budget. Build 30–50 representative cases and compare two available models plus a deterministic baseline on quality, safety, latency, tokens/cost, and limits. Record the decision and fallback.

Lab 2: Governed multimodal ingestion — 150–240 minutes¶

Process synthetic text plus image/audio inputs through validation, classification/redaction, transformation, lineage, error quarantine, deletion, and monitoring. Demonstrate malformed, sensitive, duplicate, and revoked-source cases.

Lab 3: RAG retrieval experiment — 180–300 minutes¶

Build a small authorized corpus and versioned index. Compare two chunk strategies, embedding choice/dimension, metadata filters, keyword/vector/hybrid retrieval, and optional reranking. Measure retrieval and answer/citation quality, latency, tokens, deletion, and cross-tenant denial.

Lab 4: Prompt lifecycle and regression — 120–180 minutes¶

Create a parameterized prompt with trusted/untrusted boundaries and structured output. Version it, test normal/adversarial/refusal/schema cases, canary a change, compare quality/safety/cost, and roll back on a defined threshold.

Lab 5: Bounded tool-using agent — 180–300 minutes¶

Implement an agent with one read tool and one simulated write tool. Add typed validation, scoped identity, state, idempotency, step/time/token budget, human approval, injection defense, tracing, and a kill switch. Test duplicate, permission, timeout, malicious tool output, and partial failure.

Lab 6: Streaming and asynchronous APIs — 150–240 minutes¶

Implement one streaming interaction and one SQS-backed asynchronous job. Handle authentication, quota, validation, cancellation, backpressure, partial output safety, correlation/status, retry/DLQ, idempotency, timeout, and trace propagation.

Lab 7: Safety and privacy red team — 150–240 minutes¶

Create authorized synthetic tests for direct/indirect injection, jailbreak, encoded input, PII, cross-tenant retrieval, excessive agency, unsafe output, and log/cache leakage. Layer input, retrieval, model/guardrail, tool and output controls. Measure false positives/negatives and escalation.

Lab 8: Continuous evaluation and operations — 180–300 minutes¶

Build an offline and sampled-online evaluation pipeline with versioned dataset/rubric, human-calibrated judge, retrieval/generation/agent/safety/operational/business metrics, release gate, dashboards, alerts, cost attribution, and rollback. Inject one prompt, retrieval, tool and quota fault and diagnose each.

Knowledge checks¶

First GenAI architecture artifact? A use-case, risk, data and evaluation contract—not a model choice.
Why baseline deterministic logic? It can meet some tasks more reliably/cheaply and shows whether GenAI adds value.
Larger FM always better? No; compare task quality, safety, latency, cost, availability and constraints.
Model abstraction risk? It can hide provider-specific capabilities, schemas, safety and behavior.
RAG versus customization? RAG supplies external context at inference; customization changes model behavior.
Vector-store authority? The original governed source remains authoritative; index entries are derived.
Embedding model changed for new records only? Vectors may be incompatible; version/rebuild or separate indexes deliberately.
Universal best chunk size? None; evaluate retrieval/end-to-end quality against document and use case.
Metadata filtering sufficient tenancy? No; combine identity/authorization, scoped retrieval, store controls and tests.
RAG guarantees truth? No; source quality, retrieval, context use and output validation can fail.
Prompt is configuration only? It is a versioned behavioral artifact needing tests, approval, release and rollback.
Agent tool call is authorization? No; deterministic code/IAM must authorize identity, action, resource and parameters.
Essential agent stop controls? Step, token, time, retry/cost limits plus explicit completion/escalation.
MCP makes a tool trusted? No; authenticate, authorize, validate, sandbox/allowlist and audit.
Multi-agent default advantage? No; use only when specialization benefit exceeds coordination risk/cost.
Streaming main benefit? Lower perceived time to first output; total work/cost may be unchanged.
Safe write integration? Typed validation, least privilege, state/preconditions, approval, idempotency and verification.
FM retry every failure? No; retry only retryable errors within time/cost/idempotency limits.
GenAI gateway value? Central policy, auth, quota, routing, safety, usage and observability when it does not erase needed capability.
Prompt injection defense? Treat untrusted content as data and enforce authority outside the model with layered controls.
Guardrail enough? No; combine authorization, retrieval isolation, deterministic checks, tool boundaries, monitoring and humans.
Embeddings sensitive? Yes; inherit source classification and access/lifecycle protections.
Deletion scope? Source, derived chunks/embeddings, caches, logs/feedback and retained copies per policy.
Model card purpose? Document intended use, limitations, evidence and risks; it is not a runtime control.
Exposed chain-of-thought reliable explanation? No; prefer evidence attribution, action audit and documented factors/limits.
Cost metric better than token price? Cost per successful safe business outcome.
Semantic-cache hazard? Stale, unsafe or cross-tenant answers if authorization/version/freshness are absent from the key.
Optimize context by deletion alone? No; preserve required evidence and measure quality/safety after pruning/compression.
Fast vector query means good retrieval? No; jointly measure relevance/recall, filters, freshness and answer quality.
Observe an agent with what? Request, versions, state, plan/steps, tools/arguments/results, safety, tokens/cost, outcome and approval.
Average quality enough? No; segment by risk, cohort, language, task, difficulty and adversarial cases.
LLM judge is ground truth? No; calibrate to humans with rubric, versioning, bias and disagreement analysis.
Offline evaluation enough? No; combine pre-release regression with safe canary/online monitoring and feedback.
Retrieval failure versus generation failure? Check whether correct authorized evidence was retrieved before changing the prompt/model.
Context overflow response? Detect and deliberately chunk/summarize/route; do not silently drop critical content.
Output schema unreliable means? Use constrained/structured generation where supported plus deterministic validation and retry/escalation.
Agent task success metric? Correct completed outcome and side effects, not merely a final message.
Safe model update? Versioned offline gates, compatibility checks, canary/shadow, monitoring and rollback.
Hallucination monitor from production labels absent? Use grounded/citation checks, sampled review, user correction and maintained golden sets; state limitations.
Production GenAI proof? Meets measured business, quality, safety, security, latency, reliability, and cost constraints over time.
Why current AIP guide over beta material? The standard March 2026 scope was refreshed for current services including AgentCore.
Are advanced model training techniques central? No; the target role integrates production GenAI, while advanced training is explicitly out of scope.

Places to learn¶

This is not a complete list, and it is not meant to be consumed in full. Choose one current AIP-C01 route, build the eight evidence labs, and use practice only for diagnosis. This fast-moving exam needs first-party documentation checks even when a course was updated recently.

Resource	Access	Estimated time
Official guide and AWS four-step plan	Public/free-account/subscription mix	30–45 hours selected study
Production GenAI labs/evaluation	Sandbox or subscription	45–80 hours
LinkedIn Learning AIP-C01 Cert Prep	Paid/trial	30 hours 16 minutes plus labs
Tutorials Dojo video and practice route	Paid	38–55 hours estimated
Udemy/Maarek-Kane current course	Paid	25–45 hours estimated plus labs
Udemy/Rahul Trisal architecture route	Paid	Plan 30–50 hours with labs

Official route: AWS certification page, current five-domain guide, and AIP-C01 Skill Builder plan (about 30–45 hours selected plus labs/evaluation). The live page offers an official question set and pretest path; entitlements vary.
Current broad route: LinkedIn Learning / Tutorials Dojo AIP-C01 Cert Prep (30 hours 16 minutes, advanced, released March 3, 2026; add current AgentCore/service checks).
Course/practice route: Tutorials Dojo AIP-C01 video course (27+ video hours, 10+ listed labs, 267 lessons and one 75-question test) plus practice exams (about 10–18 hours across randomized, timed, review and domain modes). Its page advertises exam-feedback-based updates; avoid recalled material and use independently authored, source-backed explanations.
Current comprehensive course: Udemy/Frank Kane and Stéphane Maarek AIP-C01 (25–45 hours estimated plus labs). Public body was blocked in this review; runtime, current update date and test count were not reverified.
Compact architecture/lab route: Udemy/Rahul Trisal AIP-C01 (plan 30–50 hours with labs). Public body was blocked; runtime, date, lab and scenario counts were not reverified. It is a focused supplement, not a substitute for professional AWS prerequisites.
Architecture reference: AWS Generative AI Lens (6–12 hours selected review/application; November 2025 publication, verify current services).
Catalog boundary: no exact current Pluralsight, O'Reilly, Whizlabs, or MeasureUp AIP-C01 product was independently verified in this review. Recheck their live catalogs rather than substituting AIF-C01 or generic Bedrock content.

Suggested preparation: an experienced production GenAI developer may need 100–150 hours; someone still building AWS/application prerequisites may need 180–280 hours including them.

Source map and freshness notes¶

The current root and five detailed domain pages define the standard assessment contract. The certification page defines live delivery; the March 2026 update establishes the standard-release refresh and AgentCore boundary; the in-scope list is non-exhaustive. Product documentation supports current behavior; learning vendors support only their catalog claims.

VERIFY CURRENT: model IDs/capabilities/context/pricing, Bedrock APIs, AgentCore, Strands, Agent Squad, MCP features, Knowledge Bases/stores, evaluation, guardrails, Cross-Region Inference, prompt caching, regions and quotas.
VERIFY CURRENT: service data-use/privacy terms, encryption/network integrations, model customization/deployment, tool/trace behavior, and training metadata before production use. The June 30 service-availability notice closes several scope-listed services/features to new customers from July 30, including Bedrock Agents Classic, Kendra, Q Business, A2I, Clarify, Ground Truth and Model Monitor. Existing-customer access differs from new-account eligibility. AgentCore is distinct from Agents Classic; choose available tooling for labs while retaining the published conceptual scope. X-Ray SDK/daemon maintenance is also distinct from X-Ray service retirement.

App Runner is closed to new customers, but the product page gives April 30, 2026 and the API notice gives March 31. The precise historical date remains blocked for vendor clarification; neither supports a new-account lab today.

Stable system pattern: outcome/risk contract → measured baseline → governed context/tools → layered controls → versioned delivery → multi-perspective evaluation → continuous observation/improvement.

This guide uses no recalled exam questions or restricted content. The knowledge checks are original and test published concepts rather than reproducing vendor items.