diff --git a/plugins/aws-startup-advisor/skills/gcp-to-aws/references/phases/clarify/clarify-ai-only.md b/plugins/aws-startup-advisor/skills/gcp-to-aws/references/phases/clarify/clarify-ai-only.md index d3b755a5..c85f042e 100644 --- a/plugins/aws-startup-advisor/skills/gcp-to-aws/references/phases/clarify/clarify-ai-only.md +++ b/plugins/aws-startup-advisor/skills/gcp-to-aws/references/phases/clarify/clarify-ai-only.md @@ -134,7 +134,7 @@ Compliance gates Bedrock regions, models, and logging **even though your infrast | SOC 2 / ISO 27001 | CloudTrail on Bedrock API calls; encryption at rest for Knowledge Bases and logs | | PCI DSS | No cardholder data in prompts without tokenization; CloudTrail + scoped IAM; dedicated logging config | | HIPAA | BAA required before PHI in prompts; BAA-eligible Bedrock models only; **Guardrails PII masking does NOT apply to CloudWatch logs — original content is logged; encrypt with KMS + restrict IAM**; us-east-1/us-west-2 preferred | -| FedRAMP | GovCloud Bedrock only (us-gov-east-1/us-gov-west-1) — materially smaller model catalog; verify target model availability before committing the migration | +| FedRAMP | GovCloud Bedrock only (us-gov-east-1/us-gov-west-1) — materially smaller model catalog, now including Grok 4.7 (SpaceXAI); verify target model availability before committing the migration | | GDPR | EU Bedrock regions (eu-west-1, eu-central-1); **geographic (`eu.`) inference profiles only — `global.` profiles route outside the EU boundary**; document cross-border transfer from GCP EU | | CCPA / CPRA | Prompt/completion retention policy; deletion workflow for logged content; CloudTrail audit logging | diff --git a/plugins/aws-startup-advisor/skills/gcp-to-aws/references/phases/design/design-ai.md b/plugins/aws-startup-advisor/skills/gcp-to-aws/references/phases/design/design-ai.md index 3b7f6cf7..e148dc9f 100644 --- a/plugins/aws-startup-advisor/skills/gcp-to-aws/references/phases/design/design-ai.md +++ b/plugins/aws-startup-advisor/skills/gcp-to-aws/references/phases/design/design-ai.md @@ -94,7 +94,7 @@ Read `preferences.json` → `design_constraints.compliance` (from full-flow Q2 o | Compliance value | Constraint applied in this design | | ---------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | `hipaa` | Candidate models restricted to **BAA-eligible Bedrock models** — verify eligibility per model via `aws___search_documentation` (AWS MCP Server) before shortlisting. Add to the code migration plan (Part 5): Bedrock invocation logging keeps ORIGINAL content in CloudWatch (Guardrails PII masking does not apply to logs) — require KMS encryption + restricted IAM on the log group. Prefer us-east-1/us-west-2. | -| `fedramp` | Target region forced to **GovCloud** (us-gov-east-1/us-gov-west-1); re-run Step 0.5 regional validation against GovCloud — the model catalog is materially smaller, and a `regional_warnings[]` entry is REQUIRED for every candidate model not available there. | +| `fedramp` | Target region forced to **GovCloud** (us-gov-east-1/us-gov-west-1); re-run Step 0.5 regional validation against GovCloud — the model catalog is materially smaller (though it now includes Grok 4.7 (SpaceXAI)), and a `regional_warnings[]` entry is REQUIRED for every candidate model not available there. | | `gdpr` | Target region restricted to EU (eu-west-1, eu-central-1); model IDs must use **geographic `eu.` inference profiles** — `global.` profiles route outside the EU boundary and are forbidden. Note the GCP-EU → AWS-EU transfer in the summary. Exclude any candidate with no `eu.` Geo profile, including Fable 5 / 5.1 and Mythos. Fable 5's in-region access is limited to `bedrock-mantle` in us-east-1; both use `us.` / `global.` profiles on `bedrock-runtime`. | | `pci` | Part 5 plan must include: no cardholder data in prompts without tokenization; CloudTrail on Bedrock API calls; scoped IAM (no `bedrock:*`). | | `soc2` / `ccpa` | Part 5 plan must include CloudTrail audit logging; CCPA additionally: prompt/completion retention policy + deletion workflow for logged content. Models whose Status is `restricted` with an `aws_review` or `provider_data_share` retention opt-in (Fable / Mythos) keep prompts outside the customer's deletion control — up to 30 days for AWS review, or shared with the provider — so exclude them under CCPA unless the plan documents that retention explicitly. | diff --git a/plugins/aws-startup-advisor/skills/gcp-to-aws/references/phases/discover/discover-preview.md b/plugins/aws-startup-advisor/skills/gcp-to-aws/references/phases/discover/discover-preview.md index 1d79f839..26d6b88e 100644 --- a/plugins/aws-startup-advisor/skills/gcp-to-aws/references/phases/discover/discover-preview.md +++ b/plugins/aws-startup-advisor/skills/gcp-to-aws/references/phases/discover/discover-preview.md @@ -101,7 +101,7 @@ the comparison is a ~10% premium (Bedrock in-region is at OpenAI's data-residenc | `gpt-5.4` (not `-pro`/`-mini`/`-nano`) | GPT-5.4 | `openai.gpt-5.4` | For the GPT-5.x rows, the mantle endpoint is in-region only (us-east-1, us-east-2; us-west-2 additionally for -Terra, Luna, and GPT-5.4; AWS GovCloud us-gov-west-1 / us-gov-east-1 for Terra and Luna, us-gov-west-1 also for +Terra, Luna, GPT-5.4, and Grok 4.7; AWS GovCloud us-gov-west-1 / us-gov-east-1 for Terra, Luna, and Grok 4.7, us-gov-west-1 also for GPT-5.4). GPT-5.6 additionally reaches most commercial regions via `bedrock-runtime` CRIS ids; GPT-5.5 / GPT-5.4 have no CRIS.