AIP-C01 — AWS Certified Generative AI Developer – Professional Cheat Sheet

Focus less on memorizing service names in isolation and more on choosing the best architecture for a scenario: secure generative AI application design, retrieval-augmented generation, agentic workflows, prompt engineering, evaluation, observability, cost control, and responsible AI controls.

Exam mindset: prefer the most managed AWS service that satisfies the requirements, but switch to lower-level control when the scenario demands custom training, custom serving, nonstandard orchestration, or deep infrastructure control.

Inference Parameter Cheat Sheet

Minimal Bedrock Converse Example

import boto3

brt = boto3.client("bedrock-runtime", region_name="us-east-1")

response = brt.converse(
    modelId="APPROVED_MODEL_OR_INFERENCE_PROFILE_ID",
    system=[{"text": "Answer only from provided context. If unsure, say so."}],
    messages=[
        {
            "role": "user",
            "content": [{"text": "Summarize the renewal risks from these excerpts: ..."}],
        }
    ],
    inferenceConfig={
        "maxTokens": 500,
        "temperature": 0.2,
    },
)

print(response["output"]["message"]["content"][0]["text"])

Use placeholders for model IDs, inference profiles, and Regions in examples; in production, restrict these through IAM, configuration, and deployment controls.

RAG Retrieval Strategy Matrix

Managed Knowledge Base vs Custom RAG

RAG Troubleshooting

Agent Pattern Selection

Agents and tool use

Agents are useful when a model must reason about which tool to call, gather information, or perform a sequence of actions. They are not a replacement for deterministic workflow design.

Agent security checklist

• Limit each tool to the minimum action needed.
• Validate tool inputs before execution.
• Use IAM roles with least privilege.
• Separate read-only tools from write or destructive tools.
• Require confirmation or human approval for irreversible actions.
• Log tool calls, inputs, outputs, and request IDs with sensitive data controls.
• Design idempotent actions where retries are possible.
• Do not let retrieved text redefine tool permissions.

Common Prompt Traps

Prompt engineering review

Good prompts reduce ambiguity. Production prompts should be versioned, tested, and treated as application assets.

Prompt mistakes to avoid

• Mixing untrusted user text with system instructions without separation.
• Asking the model to reveal hidden reasoning instead of requesting concise, auditable explanations or structured intermediate outputs.
• Depending on prompt wording alone for security-sensitive enforcement.
• Forgetting adversarial inputs such as “ignore previous instructions.”
• Using long prompts with repeated policies that increase cost and may reduce clarity.
• Not regression-testing prompt changes against known examples.

Customization Checklist

• Define baseline quality before customization.
• Split training, validation, and test sets.
• Remove secrets, regulated data, duplicates, and leakage.
• Version datasets, prompts, hyperparameters, and model artifacts.
• Evaluate against the same golden set before and after.
• Confirm deployment path, rollback, capacity, encryption, and IAM.
• Do not fine-tune to memorize dynamic business data that belongs in retrieval.

Quick final checklist

Before practice questions, make sure you can quickly answer:

• When should you use RAG instead of fine-tuning?
• How do chunk size, overlap, metadata, and top-k affect retrieval quality?
• How do you prevent one tenant from retrieving another tenant’s data?
• What controls reduce prompt injection risk?
• When is an agent appropriate, and when is Step Functions better?
• What should be logged, and what should be redacted?
• How do you evaluate groundedness, retrieval quality, and safety?
• Which cost levers reduce token usage?
• How do you deploy prompt and model changes safely?
• How do guardrails, IAM, KMS, network controls, and audit logs work together?
• How would you design rollback for a bad prompt or retrieval change?
• What metrics prove the application is improving rather than just running?

IAM Policy Shape Example

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Sid": "InvokeApprovedBedrockModels",
      "Effect": "Allow",
      "Action": [
        "bedrock:Converse",
        "bedrock:ConverseStream",
        "bedrock:InvokeModel",
        "bedrock:InvokeModelWithResponseStream"
      ],
      "Resource": [
        "arn:aws:bedrock:REGION::foundation-model/APPROVED_MODEL_ID",
        "arn:aws:bedrock:REGION:ACCOUNT_ID:inference-profile/APPROVED_PROFILE_ID"
      ],
      "Condition": {
        "StringEquals": {
          "aws:RequestedRegion": "REGION"
        }
      }
    },
    {
      "Sid": "UseApprovedKnowledgeBase",
      "Effect": "Allow",
      "Action": [
        "bedrock:Retrieve",
        "bedrock:RetrieveAndGenerate"
      ],
      "Resource": "arn:aws:bedrock:REGION:ACCOUNT_ID:knowledge-base/KB_ID"
    }
  ]
}

Adapt action names, ARNs, and conditions to the actual service feature and deployment. For exam questions, look for least privilege, approved Regions/models, and separation between app role, ingestion role, and administrative role.

Network and Data Path Decisions

Evaluation Metrics

A practical inference cost estimate should include token usage and non-token components:

Use current AWS pricing for actual calculations; the exam is more likely to test which cost drivers matter than exact prices.

Guardrails, safety, and responsible AI

Responsible AI questions often test layered controls. A single prompt instruction is not enough.

Defense-in-depth pattern

For sensitive generative AI applications, think in layers:

1. Before the model: authenticate user, authorize data access, sanitize input, classify sensitivity.
2. During retrieval: filter by permissions, freshness, tenant, and source.
3. During generation: use clear system instructions, guardrails, constrained context, and structured output.
4. After generation: validate output, redact sensitive data, check policy, route to human review if needed.
5. In operations: log safely, monitor drift, evaluate regularly, and maintain rollback options.

Latency Budget Breakdown

Performance and cost controls

AWS Observability Services

Error and Symptom Reference

Candidate mistake: assuming “more training” is always better. On AIP-C01-style scenarios, prefer the least complex option that meets the requirement: prompt template first, RAG for knowledge, fine-tuning for behavior, custom infrastructure only when managed services do not satisfy constraints.

RAG traps

• Security leak trap: retrieving documents before checking user authorization.
• Freshness trap: using stale embeddings after source documents change.
• Context stuffing trap: sending too many retrieved chunks, increasing cost and confusing the model.
• Evaluation trap: checking only final answer quality while ignoring retrieval recall and precision.
• Tenant isolation trap: using one shared vector index without metadata filtering or separate tenant isolation controls.
• Hallucination trap: telling the model to “answer confidently” instead of instructing it to answer only from provided context and say when context is insufficient.

Evaluation workflow

1. Build a golden dataset of representative prompts, expected answers, unacceptable answers, and edge cases.
2. Test retrieval separately from generation.
3. Test prompt templates and model choices against the same dataset.
4. Include safety and prompt injection cases, not just happy paths.
5. Track results over time so prompt, model, data, and retrieval changes do not silently regress.
6. Use human review for subjective tasks and high-impact decisions.

Candidate mistake: choosing a model based only on a demo response. For exam scenarios, prefer repeatable evaluation with representative data, measurable criteria, and deployment controls.

Common wrong answer: fine-tune a model on all company documents so it “knows” internal policies. RAG is usually better for current, permissioned, source-backed knowledge.

Customer support assistant

• RAG over product docs, ticket history, and approved macros.
• Output template for response draft, confidence, sources, and escalation reason.
• Human review for low confidence, high-value accounts, or sensitive categories.
• Guardrails for unsafe advice and tone.
• Feedback loop from agent edits into evaluation data.

Common wrong answer: fully automate all responses without escalation or monitoring.

Structured extraction from documents

• Preprocess documents.
• Use prompt template with required fields and output schema.
• Validate output against schema and business rules.
• Send failures to retry or human review.
• Evaluate field-level accuracy.

Common wrong answer: accept free-form generated text when downstream systems require structured data.

Natural-language operations assistant

• Agent or tool-calling interface.
• Read-only tools for search and diagnostics.
• Write tools separated and restricted.
• Step Functions or approval workflow for changes.
• Full audit logging.

Common wrong answer: allow the model to execute broad infrastructure changes directly.