Amazon Bedrock and Azure OpenAI in Australian regions

Both Amazon Bedrock and Azure OpenAI can keep inference inside Australia, but only for some models and only with the right routing option. On Bedrock, the au. geographic inference profiles route between Sydney and Melbourne, and global profiles route to any commercial region. On Azure, only Standard and Regional Provisioned deployments keep processing in the Australia geography. A Data Zone deployment in Australia East processes data across Asia Pacific.

Everything below comes from the provider documentation as of October 2026. Both providers change model lists every month, so check the live pages before you sign anything.

How Bedrock routes a request

Bedrock gives three inference options:

• In-Region. The request stays in the region you call. AWS says to use it “when regulations require strict single-Region data processing.”
• Geographic. Bedrock routes the request to a region inside a defined geography. From Sydney, AWS says you can use the au prefix, “which routes only among Australian Regions”, or the apac prefix, which can route to any supported Asia Pacific region.
• Global. Bedrock routes the request to a supported commercial region anywhere. AWS describes it as the option for workloads with no data residency constraints.

An inference profile is a named route. It defines a model and the regions that can serve it. The model card for each Claude model lists the destinations. For the AU profile, a call from Sydney or Melbourne routes to Sydney and Melbourne only. The same AU profile called from the New Zealand region can also route to New Zealand, which shows that destinations depend on the source region.

AWS warns that you must not rely on the prefix alone. Its inference profile documentation says: “If you have data residency requirements, call GetInferenceProfile from every source Region that you plan to use and verify all destination Regions in the response.” The same page gives the commands:

# List active AU inference profiles from Sydney
aws bedrock list-inference-profiles \
    --region ap-southeast-2 \
    --type-equals SYSTEM_DEFINED \
    --query "inferenceProfileSummaries[?status=='ACTIVE' && starts_with(inferenceProfileId, 'au.')].[inferenceProfileId,inferenceProfileName]" \
    --output table

# Show every destination region for one profile
aws bedrock get-inference-profile \
    --region ap-southeast-2 \
    --inference-profile-identifier au.anthropic.claude-sonnet-5-5 \
    --query 'models[].modelArn'

For an audit, note that CloudTrail logs every cross-region inference request in the source region, and the additionalEventData.inferenceRegion field shows where the request ran. Inference profiles do not support Provisioned Throughput.

Bedrock models in Sydney and Melbourne

This table groups the models by the strictest routing that the regional availability page shows, as of October 2026.

Open-weight models such as gpt-oss and Qwen3 run In-Region in Sydney with no cross-region routing. Current Claude models run in Australia through the AU profile, and in Melbourne some of them also run In-Region through the bedrock-mantle endpoint. AWS describes that endpoint as a surface for the OpenAI-compatible APIs and the Anthropic Messages API on the same inference engine. The newest OpenAI models, and the Fable and Mythos Claude models, are global only from Australia.

Bedrock data use and retention

The Bedrock FAQ says that “AWS and the third-party model providers will not use any inputs to or outputs from Amazon Bedrock to train Amazon Nova, Amazon Titan, or any third-party models.” The data protection page says model providers have no access to the Bedrock deployment accounts, and therefore no access to customer prompts and completions.

Retention depends on the model. The abuse detection page says that Bedrock uses a zero operator access model, with these exceptions as of October 2026:

• OpenAI models other than the gpt-oss family. Classifier-flagged traffic is retained for up to 30 days for automated offline abuse detection. Eligible customers can request zero data retention through their AWS account team.
• Claude Fable 5 and Fable 5.1. All traffic is retained for up to 30 days, and classifier-flagged traffic can go to human review by AWS. Customers eligible for the Enterprise Frontier Safeguards program receive zero data retention through 31 December 2026.

When cross-region inference is on, AWS stores retained data in the destination region. The data retention page adds a per-region data_retention_mode. With the mode set to none, “No request or response data is written to durable storage by AWS or shared with the model provider.” If you set none and call a model that requires retention, Bedrock blocks the request. For a regulated workload, set none in every region you use. Treat any model that fails under that mode as a model that keeps your data.

Azure deployment types and the Australia geography

Azure OpenAI is part of Microsoft Foundry. The deployment types page defines where each type processes prompts:

The Azure regions list puts Australia East in New South Wales, in the Australia geography. Its paired region is Australia Southeast. For Standard and Regional Provisioned, Microsoft says prompts and responses are processed in the customer-specified geography and “might be processed between regions within that geography for operational purposes.” For an Australia East resource, only those two types keep processing in Australia.

The Data Zone types do not. The region availability page says the Asia Pacific data zone processes “data within any Asia Pacific nation”. The APAC Data Zone tables list Australia East with Japan East, Korea Central, Southeast Asia and South India. The deployment types page also says Microsoft can add regions to a data zone without prior notice.

You can block the types you do not want with Azure Policy. Microsoft gives a rule that matches one SKU name. This version denies every deployment that is not Standard or Regional Provisioned:

{
  "mode": "All",
  "policyRule": {
    "if": {
      "allOf": [
        { "field": "type", "equals": "Microsoft.CognitiveServices/accounts/deployments" },
        { "field": "Microsoft.CognitiveServices/accounts/deployments/sku.name",
          "notIn": ["Standard", "ProvisionedManaged"] }
      ]
    },
    "then": { "effect": "deny" }
  }
}

Azure models in Australia East

From the region availability page, as of October 2026:

A pay-per-token deployment that stays in Australia gets gpt-4.1-mini and gpt-4o. The GPT-5 family in Australia needs Regional Provisioned capacity, which you buy in provisioned throughput units (PTUs), a reserved unit of model capacity. Microsoft says geography-based deployment types arrive last and have no guaranteed availability date.

Azure data use and abuse monitoring

The Azure data privacy page says prompts, completions, embeddings and training data are not available to OpenAI and are “NOT used to train any generative AI foundation models without your permission or instruction.” For Global and Data Zone types, Microsoft says only the processing location changes. Data at rest, including the abuse monitoring data store, stays in the customer-designated geography.

Abuse monitoring runs by default. Flagged prompts and completions go to automated review first. Human review by authorised Microsoft employees can follow, through Secure Access Workstations with just-in-time approval. Customers who meet Limited Access criteria can apply for modified abuse monitoring, and approved customers see "ContentLogging": "false" in the resource properties.

Private endpoints

Both services support private network access. On AWS, an interface VPC endpoint (AWS PrivateLink) lets a VPC reach Bedrock “without the use of an internet gateway, NAT device, VPN connection, or Direct Connect connection”. Service names exist for bedrock-runtime, bedrock-mantle and the agent APIs. An endpoint policy limits which principals and actions can use it. On Azure, a private endpoint gives the Foundry resource an IP address in your virtual network. You can then configure the firewall to block all connections on the public endpoint.

A private endpoint controls the network path. It does not change where the provider processes the request. A private endpoint in Sydney with a global inference profile still sends prompts offshore.

Comparison

Where the documentation is unclear

Five gaps came up in this review. Raise each one with your account team in writing.

• The Bedrock inference profile page still says the global profile “is currently only supported on Anthropic Claude Sonnet 4”. The note looks out of date, because the regional availability page lists global profiles for many models.
• For GLM 5.3 and Nova Micro, the regional table shows geography routing from Sydney, but the model cards list no au. or apac. profile ID for either model.
• Azure says human reviewers for European Economic Area deployments are located in the EEA. Neither Azure page states where reviewers for Australian deployments are located.
• The current Azure data privacy and abuse monitoring pages do not state a retention period for prompts stored for human review.
• One Azure page says Standard deployments process data “in the region associated with your deployment”. Another says processing can move between regions within the geography. For Australia East, both readings stay inside Australia.

What to check next

Choose the model first, then read its routing row in the tables above. If the model is global only from Australia, you need an APP 8 assessment and possibly a CPS 230 offshoring notification. The article on data sovereignty and residency covers both. For each region you use, set the strictest retention mode and block unwanted deployment types with policy. Keep the routing evidence in your audit file. If no hosted model passes, an open-weight model on your own GPUs is the next option, and the guide on choosing open-weight models compares them.

We connect these services to your documents and systems as part of LLM integration and RAG builds, and we deploy self-hosted models through on-prem AI deployment.