If a company adopts Amazon Bedrock, which security responsibility remains the company's responsibility?

Amazon Bedrock operates under the AWS shared responsibility model. AWS is responsible for the security of the cloud, meaning they manage the underlying infrastructure, including physical security and patching the Bedrock service itself. Customers are responsible for security in the cloud. This includes securing their data, both in transit (e.g., using TLS) and at rest (e.g., using encryption with KMS). Deploying Bedrock inside a company's own network is incorrect as Bedrock is a fully managed AWS service accessed over the internet, not deployed on-premises.