SageMaker AI, Bedrock, Kendra, Personalize and Textract

By the end of this lesson you will be able to

• Apply the golden rule of this chapter: pick a pre-trained managed AI service first, and choose SageMaker AI only when no ready-made service fits and you must train a model on your own data.
• Walk through the machine learning lifecycle in SageMaker AI (data, labelling, building, training and tuning, deploying, monitoring) and name the tool for each step.
• Choose between real-time, serverless, asynchronous and batch inference from payload size, processing time and traffic pattern.
• Explain what Amazon Bedrock does with foundation models, retrieval-augmented generation (RAG), Guardrails and agents, what became of Amazon Q, and how the SAA-C03 exam treats generative AI.
• Recognise the exam scenarios for Amazon Kendra (enterprise search in natural language), Amazon Personalize (real-time recommendations) and Amazon Textract (forms, tables and handwriting from documents), and know the current status of each.
• Use one cheat sheet for every AI service of chapter 18, and design the event-driven pattern upload → S3 → Lambda → AI service, including asynchronous jobs, the Lambda time limit and duplicate events.

#Build your own model, or use a ready-made one?

Lesson 18.1 covered the pre-trained AI services: Rekognition, Transcribe, Polly, Translate, Lex, Comprehend. Somebody at AWS already collected millions of examples, trained the model and runs it; you send a request and get an answer. This lesson adds the other side, building your own model with SageMaker AI, then generative AI with Bedrock, and three more ready-made services: Kendra, Personalize and Textract.

The exam theme of the whole chapter is one decision. Read the scenario, find the keywords, and ask: does a managed, pre-trained service already do this? If yes, that is the answer, because it means no data scientists, no training data, no servers and no model to keep healthy. Only when the question says the ready-made services cannot do the job (a defect only your factory makes, a prediction from your own business data) and you must train a custom model on your own data is SageMaker AI right.

#Amazon SageMaker AI

Amazon SageMaker AI is AWS’s fully managed, end-to-end machine learning platform for developers and data scientists. Without it, a team must collect and label data, rent and configure GPU servers, install frameworks, run training, keep track of experiments, then build and scale an API to serve the model, all in different places. SageMaker AI puts every step in one service, starts the servers for each job and stops them when the job ends.

#The machine learning lifecycle

Machine learning learns a rule from examples instead of a programmer writing the rule. Take the slides’ example: predicting a student’s exam score.

1. Historical data

   Collect past examples with the facts you think matter: years of IT experience, years with AWS, hours spent on the course, practice-test results. Thousands of past students, in S3.

2. Label

   Attach the answer you want the model to learn to each example: this student scored 670, that one 890, another 934. A labelled example is “inputs plus the right answer”. For photos or documents a human often has to add the label; that is what SageMaker Ground Truth organises.

3. Build

   Choose an algorithm (a built-in one, or your own code in PyTorch, TensorFlow or scikit-learn) and write the training script, in a notebook in SageMaker Studio.

4. Train and tune

   A training job starts the instances you ask for (GPU or CPU), reads the data from S3, learns, writes the model artifact back to S3 and shuts down; you pay for the minutes used. Automatic model tuning runs many training jobs with different settings (learning rate, tree depth) and keeps the best.

5. Deploy and predict

   Put the model behind an endpoint and send it new data: a new student’s experience and study hours. The model answers “predicted score 906: pass”. Using a trained model to answer is called inference.

6. Monitor and retrain

   The world changes, so a model that was right last year slowly becomes wrong (drift). Compare live inputs and predictions with the training baseline, and retrain on fresh labelled data when quality drops.

#The tools along the way

#Deploying a model: four ways to get predictions

How you deploy depends on how the predictions are needed: one at a time and instantly, now and then, large and slow, or millions at once on a schedule.

#Security and cost of SageMaker AI

• IAM roles: training jobs, endpoints and notebooks run with an execution role that grants exactly the S3 buckets and KMS keys they need (chapter 2).
• Network: jobs and endpoints can run in your VPC subnets with security groups; with network isolation a training container cannot reach the internet at all; callers reach endpoints privately through VPC interface endpoints (PrivateLink, lesson 22.2).
• Encryption: data, model artifacts and attached volumes encrypted with KMS keys (lesson 21.2); TLS in transit.
• Cost: training is billed per second of instance time and stops with the job; use managed Spot training with checkpoints for large savings. A real-time endpoint bills every hour it runs, even when nobody calls it, so idle endpoints are the classic surprise on the bill: choose serverless or asynchronous (scale to zero) for spiky traffic, and delete endpoints you do not use.

#Generative AI: Amazon Bedrock and Amazon Q

#Foundation models and Bedrock

A foundation model (FM) is a very large model trained on a huge amount of general data (text, code, images) that can do many tasks it was not specifically trained for: answer questions, summarise, write, classify, extract. A large language model (LLM, met in lesson 17.3) is a text foundation model. Training one costs millions of dollars, so nearly every company uses foundation models rather than building them.

Amazon Bedrock is the fully managed, serverless way to use foundation models through one API. You choose a model from Amazon or from other providers, send it a prompt, and pay per token (or buy provisioned throughput). There are no GPUs or servers to manage. The pieces worth knowing:

• Model choice: models from several providers behind the same API; the Converse API lets you switch models without rewriting the call.
• Knowledge Bases (RAG): point Bedrock at your documents (in S3, SharePoint, Confluence and other sources). It splits them into chunks, turns them into vectors with an embedding model, stores them in a vector store (OpenSearch Serverless, Aurora PostgreSQL, S3 Vectors or a store Bedrock manages), and at question time retrieves the relevant chunks and adds them to the prompt so the model answers from your data, with citations. This is retrieval-augmented generation (RAG).
• Guardrails: policies applied to prompts and answers: blocked topics, content filters, PII detection and masking, and grounding checks that catch answers not supported by the retrieved text.
• Agents: the model plans steps and calls your APIs or Lambda functions (check an order, book an appointment). Bedrock Agents (now in maintenance as “Agents Classic”) and the newer AgentCore run them.
• Customisation: fine-tuning with labelled examples, continued pre-training on unlabelled domain text, and distillation into a smaller, cheaper model. Try prompting and RAG first; customising costs more.
• Privacy: your prompts and data are not used to train the base models and are not shared with model providers; traffic can stay private through PrivateLink, encrypted with KMS.

#Bedrock or SageMaker AI for generative AI

• Bedrock: use a foundation model through an API, serverless, pay per use, with RAG, guardrails and agents built in. The default answer for “add generative AI with the least operational overhead”.
• SageMaker AI (JumpStart, training and endpoints): when you must host the model yourself on instances you choose, use a model Bedrock does not offer, or train and fine-tune with full control of the code. More control, more to operate.

#What became of Amazon Q

Amazon Q was launched in 2023 as AWS’s generative AI assistant in two products, and both have moved on:

• Amazon Q Business answered employees’ questions from company data through connectors. In October 2025 AWS launched Amazon Quick Suite (now Amazon Quick), which includes Quick Sight, the former QuickSight (lesson 17.5); in June 2026 AWS put Q Business into maintenance, and since 30 July 2026 it is no longer open to new customers, with Amazon Quick as the recommended replacement.
• Amazon Q Developer is the coding and AWS-console assistant. Its IDE plugins and paid subscriptions reach end of support on 30 April 2027, with Kiro as the successor; Q in the AWS console continues.

#Amazon Kendra

Amazon Kendra is a fully managed, ML-powered enterprise document search service. It reads documents where they already live (text, PDF, HTML, PowerPoint, Word, question-and-answer lists), builds an index, and answers natural-language questions with the answer itself, not just a list of files that contain the words.

Type “Where is the IT support desk?” into an ordinary keyword search and you get 50 documents that contain “IT” and “desk”. Kendra understands it is a location question, finds the sentence in the facilities guide, and replies “1st floor”, with the document as the source.

• Connectors index S3, RDS and other databases, SharePoint, OneDrive, Google Drive, Salesforce, Confluence, ServiceNow, websites and more (over 30), and you can push documents through the API for anything else.
• Access control: results are filtered by the user’s and groups’ permissions on each document, so an intern does not find the board minutes.
• Incremental learning: Kendra learns from user interactions and feedback (clicks, thumbs up) and promotes the results people found useful.
• Tuning: you can manually boost results by importance of the data source, freshness (newer documents first) or custom fields.
• RAG retriever: a Kendra index can be the retriever for Bedrock Knowledge Bases (and was for Q Business), so a generative assistant answers from the same indexed documents.

#Amazon Personalize

Amazon Personalize is a fully managed ML service for real-time personalised recommendations, built on the same technology Amazon.com uses. You do not choose algorithms or run servers: you give it three kinds of data (interactions: who clicked, bought or watched what and when; items: product or article details; users: optional profile data), choose a recipe for the job (recommendations for a user, similar items, personalised re-ranking of a list, trending now), and it trains a model and serves it through a campaign or recommender.

• Real time: your app sends each click or purchase with PutEvents through an event tracker, and the next recommendation reflects it within seconds, without retraining.
• Example from the slides: a user bought gardening tools, so recommend the next thing to buy.
• Everywhere you talk to customers: websites, mobile apps, SMS and email marketing (batch jobs produce per-user lists or user segments for a campaign).
• Implement in days, not months: no need to build, train and deploy an ML solution yourself.
• Use cases: retail and e-commerce, media and entertainment (what to watch or read next), personalised marketing.

#Amazon Textract

Amazon Textract automatically extracts printed text, handwriting and data from scanned documents (images and PDF files) using machine learning. Ordinary optical character recognition (OCR) turns an image into lines of text and stops there; Textract also keeps the structure:

• Forms as key-value pairs: “Account No:” → “1234 5678”, “Date of birth:” → “23.05.1997”, and checkboxes as selected or not.
• Tables as rows, columns and cells, including merged cells and headers.
• Queries: ask in plain English (“What is the applicant’s monthly income?”) and get the value back, without knowing where on the page it sits.
• Signatures and layout (titles, paragraphs, lists, headers and footers).

Specialised APIs:

• AnalyzeExpense for invoices and receipts: vendor, date, total, tax and line items, whatever the layout.
• AnalyzeID for identity documents: today it supports only US passports and US driver’s licences.
• AnalyzeLending for mortgage and loan packets: it classifies each page and extracts each document type.

Use cases from the slides: financial services (invoices, financial reports), healthcare (medical records, insurance claims), public sector (tax forms, ID documents, passports).

#Synchronous or asynchronous

Limits that matter in Bangladesh: Textract reads English, French, German, Italian, Portuguese and Spanish, and handwriting only in English. Bengali text is not supported, so a form filled in Bengali is not a Textract job.

#Other AI services you may still meet

Earlier versions of the SAA-C03 guide (version 1.1) listed Forecast, Fraud Detector and Kendra in scope; the current list does not. Know their one-line keyword, but do not design new systems on them.

#Cheat sheet: every AI service in chapter 18

The notes’ cheat sheet arrived as broken lines; here it is as one table, with every service of the chapter. Services from lesson 18.1 are taught there. The last column shows where each service stands on the current SAA-C03 exam guide: in scope, out of scope, or not listed at all (v1.1 is the earlier version of the guide).

#The event-driven AI pattern

AI services are usually not called by a person pressing a button but by an event. The pattern the exam asks about again and again:

User uploads a file → S3 bucket → S3 event notification (or EventBridge) → Lambda function → AI service (Textract, Transcribe, Rekognition, Comprehend) → result stored in DynamoDB or S3.

1. The app uploads to S3 (with a pre-signed URL, lesson 10.1).
2. An S3 event notification for ObjectCreated invokes a Lambda function, or sends the event to EventBridge, which can filter on more fields and route to several targets (lesson 10.7, lesson 19.5).
3. Lambda calls the AI service with the bucket and key; the service reads the object from S3 itself.
4. The result goes to DynamoDB (for the app to query, lesson 15.4) or to S3 as JSON.

Three things go wrong in real systems, and the exam knows them:

• Long jobs are asynchronous. A multi-page PDF, a one-hour call recording or a long video cannot be processed inside one request. Use the asynchronous API (StartDocumentAnalysis, StartTranscriptionJob, StartLabelDetection): it returns a job ID at once, and the service announces completion on an SNS topic (Transcribe through EventBridge), which triggers a second Lambda to fetch and store the result. Sending a 300-page PDF to the synchronous AnalyzeDocument fails: it accepts one page.
• Lambda runs for at most 15 minutes (lesson 15.1). A function that starts a job and then waits in a loop for a long video wastes money and times out. Start the job, return, and let the completion event start the next step (or use Step Functions to wait without paying for Lambda time).
• Events can arrive more than once. S3 event notifications are delivered at least once, and Lambda retries asynchronous invocations on errors. Without idempotency, one invoice is processed twice: two Textract bills and two rows in the payments table. Make the handler idempotent, for example by writing the object key and version (or ETag) to DynamoDB with a conditional write before doing the work, and skipping the event if the key is already there.

# Lambda: S3 ObjectCreated → start an asynchronous Textract job, once per object version
import boto3, hashlib, os, urllib.parse
ddb = boto3.client("dynamodb")
textract = boto3.client("textract")

def handler(event, context):
    for rec in event["Records"]:
        bucket = rec["s3"]["bucket"]["name"]
        key = urllib.parse.unquote_plus(rec["s3"]["object"]["key"])
        version = rec["s3"]["object"].get("versionId", rec["s3"]["object"]["eTag"])
        try:  # idempotency: only the first delivery of this object version wins
            ddb.put_item(
                TableName=os.environ["JOBS_TABLE"],
                Item={"pk": {"S": f"{bucket}/{key}#{version}"}, "status": {"S": "STARTED"}},
                ConditionExpression="attribute_not_exists(pk)",
            )
        except ddb.exceptions.ConditionalCheckFailedException:
            continue  # duplicate event: already started
        job = textract.start_document_analysis(
            DocumentLocation={"S3Object": {"Bucket": bucket, "Name": key}},
            FeatureTypes=["FORMS", "TABLES"],
            NotificationChannel={"SNSTopicArn": os.environ["TOPIC_ARN"],
                                 "RoleArn": os.environ["TEXTRACT_ROLE_ARN"]},
            ClientRequestToken=hashlib.sha256(f"{key}#{version}".encode()).hexdigest()[:64],
        )
        print("started", key, job["JobId"])  # a second function handles the SNS message

#What goes wrong

• A SageMaker project for a solved problem: weeks spent training a model to find explicit images, while Rekognition content moderation does it with one API call. Check the managed services first.
• The model slowly becomes wrong: data drifted (new supplier, new customer behaviour, inflation) and nobody watched. Monitor inputs and quality, keep fresh labels, retrain on a schedule or on alarm.
• A large or slow request fails on a real-time endpoint: payload over 25 MB or processing over 60 seconds. Use asynchronous inference.
• The bill shows endpoints running all month: real-time endpoints bill every hour. Use serverless or asynchronous with scale to zero for spiky traffic, batch transform for scheduled scoring, and delete test endpoints.
• The chatbot invents policies: a foundation model without RAG answers from general knowledge. Add a Knowledge Base and grounding checks.
• Kendra returns a document the user should not see: documents were indexed without their access lists, or the query does not pass the user’s identity. Index with permissions and pass the user and groups.
• Recommendations ignore what the user just did: the app never sends PutEvents, so Personalize only knows yesterday’s batch import.
• Textract returns flat text from a form: the call used DetectDocumentText (plain OCR); use AnalyzeDocument with the forms and tables features, or Queries.
• A 300-page PDF fails: sent to the synchronous API. Use StartDocumentAnalysis with an SNS topic.
• A Bengali form comes back as garbage, or an NID card fails in AnalyzeID: Textract does not read Bengali, and AnalyzeID reads only US documents.
• The Lambda function times out: it waited for an asynchronous job. Return after starting it and react to the completion event.
• The same file is processed twice: duplicate S3 events and retries without idempotency.

#AI services in system design

Patterns to remember:

• Document intake: S3 → Lambda → Textract (async + SNS) → DynamoDB, with A2I or a review screen for low-confidence fields.
• Media processing: S3 → Lambda → Transcribe or Rekognition video (async jobs) → results to S3 → Comprehend for text insights → OpenSearch for search.
• Custom predictions: data in S3 → SageMaker AI training → real-time endpoint behind API Gateway and Lambda, or batch transform at night writing scores back to S3 for Athena and QuickSight.
• Generative assistants: Bedrock + Knowledge Base (documents in S3, vectors in OpenSearch Serverless or managed storage) + Guardrails, called from Lambda behind API Gateway.
• Personalisation: Personalize campaign called by the web and app back end, with PutEvents from the front end; batch segments for email campaigns.

#Try it yourself

These commands use the AWS CLI v2 in ap-south-1 (Mumbai, close to Bangladesh) with placeholder account 111122223333. Every call is billed per request, page, minute or instance-hour; delete the SageMaker endpoint when you finish.

# 1. Textract: a one-page loan form, synchronously, with forms, tables and a query
aws textract analyze-document \
  --document '{"S3Object":{"Bucket":"loan-scans-example","Name":"2026/11/form-0042.png"}}' \
  --feature-types FORMS TABLES QUERIES \
  --queries-config '{"Queries":[{"Text":"What is the monthly income?","Alias":"INCOME"}]}' \
  --query 'Blocks[?BlockType==`QUERY_RESULT`].[Text,Confidence]'
# [ [ "BDT 85,000", 97.8 ] ]

# 2. Textract: a 120-page statement, asynchronously, with an SNS completion message
aws textract start-document-analysis \
  --document-location '{"S3Object":{"Bucket":"loan-scans-example","Name":"2026/11/statement-0042.pdf"}}' \
  --feature-types TABLES \
  --notification-channel SNSTopicArn=arn:aws:sns:ap-south-1:111122223333:textract-done,RoleArn=arn:aws:iam::111122223333:role/TextractSnsRole
# { "JobId": "4a1c0b7e9d0f..." }
aws textract get-document-analysis --job-id 4a1c0b7e9d0f... --max-results 1000 \
  --query '[JobStatus,DocumentMetadata.Pages]'
# [ "SUCCEEDED", 120 ]      (IN_PROGRESS until the SNS message arrives)

# 3. Textract: a receipt
aws textract analyze-expense \
  --document '{"S3Object":{"Bucket":"loan-scans-example","Name":"receipts/r-981.jpg"}}' \
  --query 'ExpenseDocuments[0].SummaryFields[?Type.Text==`TOTAL`].ValueDetection.Text'
# [ "1,250.00" ]

# 4. Kendra: a natural-language question (existing index)
aws kendra query --index-id 0f9a2c4e-1b2d-4c3e-8f5a-6b7c8d9e0f1a \
  --query-text "Where is the IT support desk?" \
  --query 'ResultItems[0].[Type,DocumentExcerpt.Text]'
# [ "ANSWER", "The IT support desk is on the 1st floor, room 104." ]

# 5. Personalize: send a click, then ask for recommendations (existing campaign)
aws personalize-events put-events --tracking-id 5e6f7a8b-2c3d-4c1d-9e2f-0a1b2c3d4e5f \
  --user-id u-2041 --session-id s-77 \
  --event-list '[{"eventType":"click","itemId":"panjabi-117","sentAt":"2026-11-01T10:15:00Z"}]'
aws personalize-runtime get-recommendations \
  --campaign-arn arn:aws:personalize:ap-south-1:111122223333:campaign/shop-home \
  --user-id u-2041 --num-results 3
# { "itemList": [ {"itemId":"panjabi-122"}, {"itemId":"nagra-031"}, {"itemId":"attar-009"} ] }

# 6. SageMaker AI: a training job on Spot, then a serverless endpoint
aws sagemaker create-training-job --training-job-name defect-v7 \
  --algorithm-specification TrainingImage=111122223333.dkr.ecr.ap-south-1.amazonaws.com/defect-train:1.4,TrainingInputMode=File \
  --role-arn arn:aws:iam::111122223333:role/SageMakerExecRole \
  --input-data-config '[{"ChannelName":"train","DataSource":{"S3DataSource":{"S3DataType":"S3Prefix","S3Uri":"s3://defects-example/train/"}}}]' \
  --output-data-config S3OutputPath=s3://defects-example/models/ \
  --resource-config InstanceType=ml.g5.xlarge,InstanceCount=1,VolumeSizeInGB=50 \
  --enable-managed-spot-training \
  --stopping-condition MaxRuntimeInSeconds=14400,MaxWaitTimeInSeconds=21600
aws sagemaker create-endpoint-config --endpoint-config-name defect-v7-sls \
  --production-variants '[{"VariantName":"main","ModelName":"defect-v7","ServerlessConfig":{"MemorySizeInMB":4096,"MaxConcurrency":5}}]'
aws sagemaker create-endpoint --endpoint-name defect --endpoint-config-name defect-v7-sls
aws sagemaker-runtime invoke-endpoint --endpoint-name defect \
  --content-type image/jpeg --body fileb://piece-5512.jpg out.json && cat out.json
# {"label": "oil_spot", "score": 0.94, "box": [412, 180, 470, 236]}
aws sagemaker delete-endpoint --endpoint-name defect

# 7. Bedrock: one question to a foundation model (model access already enabled)
aws bedrock-runtime converse --model-id amazon.nova-lite-v1:0 \
  --messages '[{"role":"user","content":[{"text":"In one sentence, what is Amazon Textract?"}]}]' \
  --query 'output.message.content[0].text'
# "Amazon Textract is an AWS service that extracts text, forms and tables from scanned documents."

Also try in the console: upload a scanned form to the Textract demo page and compare the Raw text tab with the Forms and Tables tabs, which is the difference between OCR and Textract in one screen.

#Summary

Key takeaways

• Golden rule: a managed pre-trained service first; SageMaker AI only when no ready-made service fits and a custom model must be trained on your own data. Over-engineering with SageMaker is a classic wrong answer.
• SageMaker AI (renamed from SageMaker in December 2024; “SageMaker” now also names the unified data and AI platform with Unified Studio) = the end-to-end ML platform: data → label (Ground Truth) → build (Studio, JumpStart, no-code Canvas/Autopilot) → train and tune → deploy → monitor (Model Monitor, Clarify). Ground Truth, Model Monitor, Clarify and A2I closed to new customers on 30 July 2026.
• Inference: real-time (steady, low latency, 25 MB, 60 s), serverless (spiky, cold starts, 4 MB), asynchronous (1 GB, 1 hour, S3 + SNS, scale to zero), batch transform (whole datasets, no endpoint).
• Bedrock = serverless foundation models through one API, with Knowledge Bases (RAG), Guardrails, agents and fine-tuning. Amazon Q Business → Amazon Quick (closed to new customers 2026); Q Developer → Kiro (end of support April 2027). Bedrock and Q are not on the SAA-C03 in-scope list.
• Kendra = ML-powered enterprise search with natural-language answers (“Where is the IT support desk?” → “1st floor”), connectors, permissions, incremental learning; in maintenance since June 2026, Bedrock Knowledge Bases for new projects.
• Personalize = real-time recommendations with Amazon.com’s technology, PutEvents for live behaviour, marketing emails; out of scope for SAA-C03 today.
• Textract = text, handwriting, forms (key-value), tables, Queries, AnalyzeExpense, AnalyzeID (US documents only); sync 1 page / 10 MB, async 3,000 pages / 500 MB with SNS; English and five European languages. Photos → Rekognition; documents → Textract.
• Forecast (closed 2024) and Fraud Detector (closed 2025) appear only in older questions.
• Pattern: upload → S3 → event (or EventBridge) → Lambda → AI service → DynamoDB/S3; long work as async jobs + SNS; Lambda max 15 minutes; idempotent handlers for duplicate events; managed services = operational excellence.

Self-check: SageMaker AI, Bedrock, Kendra, Personalize and Textract30 questions