From managed to hybrid · AI architecture

Bedrock, SageMaker AI or OpenShift AI? Choose the layer by constraint.

A map of six AI architecture layers, from ready-made services to your own GPUs, with the questions, diagrams and cost numbers I use in client reviews and in my lecture on AI architectures at Hochschule Burgenland.

  • 6 layers explained
  • Decision tool
  • Break-even numbers
  • Sources linked
The short version

Managed or self-managed is the SaaS, PaaS, IaaS question again.

Every AI system sits on a layer. The higher the layer, the more the provider operates for you; the lower, the more control you get and the more your team has to run[2].

Pick the layer by constraint, not by preference: where the data may go, how much you need to customise, how steady the load is, how fast it must answer, and which skills you have.

Hybrid is not a layer. It is what happens when one constraint, usually data residency, forces part of the system onto a lower layer. On list prices, managed services win for almost everyone[3][4]; residency and control, not price, are what justify running your own.

Hybrid is a constraint decision, not an architecture style.
Six AI architecture layers from L0 consumer AI products to L5 infrastructure and hardware, with people, business, technology and governance perspectives.
The six layers, L0 to L5. Each step down: more you run, more you control, more that can break.Source: Linda Mohamed, lecture “Von Managed zu Hybrid: KI-Architekturen”, Hochschule Burgenland, 2026
Decision tool

Five questions, one suggested layer.

Runs in your browser, nothing is sent. The suggestion follows the same logic I use at the start of an architecture review.

Which layer fits your use case?

Five questions. The suggestion is a starting point for the review, not a verdict.

1. What does the AI need to do?

2. Where may the data go?

3. How much customisation?

4. How steady and large is the load?

5. Who would operate it?

The map

Six layers, who operates what.

Examples on AWS first, equivalents on other clouds where they exist. Service names change; the layers do not.

LayerNameExamplesWhat you operate
L0Consumer AI productClaude, Microsoft 365 Copilot, Gemini in Workspace, Notion AIThe tenant: sign-in, retention, connectors
L1Ready-made capabilityAmazon Textract, Transcribe, Rekognition, Comprehend, Bedrock Data AutomationYour process calls an API and gets structured data back
L2Managed modelAmazon Bedrock with Knowledge Bases, Guardrails and AgentCore; Microsoft Foundry; Vertex AIModel choice, prompts, retrieval, guardrails, evaluation
L3Managed platformAmazon SageMaker AI; Azure Machine Learning; Vertex AIYour data, code, training jobs and endpoints
L4Your own platformRed Hat OpenShift AI on ROSA, ARO or on-premises; Kubernetes with vLLM and KServeThe runtime, upgrades, scaling, failures
L5InfrastructureGPU instances such as EC2 G6e, AWS Outposts, own racks; FSx for NetApp ONTAP as storage bridgeThe machines, networks and storage
IaaS, PaaS, SaaS and AI as a service compared by what you rent and what you operate.
The same logic as the classic cloud service models: rent a machine, deploy code, or call something that is already running.Source: Linda Mohamed, lecture “Von Managed zu Hybrid: KI-Architekturen”, Hochschule Burgenland, 2026
Layer 1 and 2

Ready-made capability or managed model.

The most common decision. Amazon Textract returns fixed fields for one page synchronously and up to 3,000 pages asynchronously[9]; a model on Bedrock follows a prompt and needs evaluation.

Layer 1: documents, audio, images and text go into a ready-made capability and come back as fields, transcripts, labels and entities.
Layer 1: you send a document, audio, image or text and get structured output. You shape it with Rekognition Custom Labels, Transcribe custom vocabularies or Textract adapters.Source: Linda Mohamed, lecture “Von Managed zu Hybrid: KI-Architekturen”, Hochschule Burgenland, 2026
Layer 2: your application, private data and retrieval in your environment; only permitted context crosses to the managed model endpoint.
Layer 2: your environment keeps the data and retrieval; only permitted context crosses to the model endpoint. You configure model, retrieval, tools, guardrails and evaluation.Source: Linda Mohamed, lecture “Von Managed zu Hybrid: KI-Architekturen”, Hochschule Burgenland, 2026
Layer 3 and 4

Rent the platform or hold the platform.

SageMaker AI runs the ML lifecycle for you and bills four meters: notebooks, training, hosting and extras such as MLflow[7]. OpenShift AI gives you the same lifecycle on a platform you run, on ROSA, ARO or on-premises[11][12].

Side by side: SageMaker AI as a rented platform in AWS versus Red Hat OpenShift AI with Kubeflow, Ray and vLLM as a platform you hold.
Layer 3 against layer 4. SageMaker AI runs in one place, AWS. OpenShift AI runs wherever you run OpenShift: a Region, your building, or both.Source: Linda Mohamed, lecture “Von Managed zu Hybrid: KI-Architekturen”, Hochschule Burgenland, 2026
OpenShift AI platform architecture: workbench, training job, model registry, endpoint and pipeline on OpenShift AI with vLLM and Kubernetes on GPUs.
What you operate on layer 4: the workbenches, training jobs, registry, endpoints and pipelines look the same for users; your team runs OpenShift AI, the vLLM runtime[17], Kubernetes and the GPUs.Source: Linda Mohamed, lecture “Von Managed zu Hybrid: KI-Architekturen”, Hochschule Burgenland, 2026
Serving on layer 3

Four ways to serve a model, four ways to pay.

Real-time endpoints bill while they exist; serverless bills per request; asynchronous scales to zero if configured; batch bills only while it runs. The payload and time limits decide as much as the price[8].

SageMaker AI inference options: real-time (25 MB payload), serverless (4 MB, 60 seconds), asynchronous (1 GB, one hour), batch transform (100 MB per record), with when the meter runs.
Real-time up to 25 MB payloads, serverless 4 MB and 60 seconds, asynchronous 1 GB and one hour, batch transform 100 MB per record.Source: Linda Mohamed, lecture “Von Managed zu Hybrid: KI-Architekturen”, Hochschule Burgenland, 2026
Hybrid

Route by data classification.

Amazon Bedrock does not run on AWS Outposts; what reaches on-premises data are agents and tools[15][16]. The practical pattern is routing: a managed model in an EU Region for data that may leave, a self-hosted model in the building for data that may not.

Request routing: the application classifies each request; public and internal data go to Amazon Bedrock in an AWS Region, restricted data to vLLM on OpenShift AI in your building; both write an audit trail.
One endpoint for the application, a classifier in front, two inference targets behind, one audit trail. Cross-Region inference on Bedrock needs its own residency check[18].Source: Linda Mohamed, lecture “Von Managed zu Hybrid: KI-Architekturen”, Hochschule Burgenland, 2026
Layer 5 hybrid boundary: original data and systems stay in your organisation; only allowed data crosses to managed AI in the cloud and results come back.
The boundary is the decision: what may cross, and what comes back. Storage bridges such as FSx for NetApp ONTAP with S3 access points let cloud services read file shares without copying everything[14].Source: Linda Mohamed, lecture “Von Managed zu Hybrid: KI-Architekturen”, Hochschule Burgenland, 2026
Anonymised geospatial planning example: public data is queried in the cloud, private parcel data is read by an agent inside the building, only facts cross.
An anonymised reference project: a planner asks in plain language; public geodata is processed in the cloud, the private half of the question is answered by an agent inside the building. Owner names never cross.Source: Linda Mohamed, lecture “Von Managed zu Hybrid: KI-Architekturen”, Hochschule Burgenland, 2026
Cost

When does your own GPU pay off?

List prices, us-east-1, checked August 2026[3][4][5]. The break-even is a utilisation requirement, not a capability limit: one L40S GPU can serve an 8B model faster than this rate[6], the question is whether your traffic keeps it busy all month.

ModelAmazon BedrockSelf-hosted on EC2Break-even per month
Llama 3.1 8B InstructUSD 0.22 per 1M tokensg6e.xlarge, USD 1.861/h = USD 1,358.53 per 730-h month6.18 bn tokens (about 2,350 tokens/s around the clock)
Llama 3.3 70B InstructUSD 0.72 per 1M tokensg6e.12xlarge, USD 10.49/h on demand10.6 bn tokens
Llama 3.3 70B InstructUSD 0.72 per 1M tokensg6e.12xlarge, USD 6.61/h with 1-year reservation6.7 bn tokens

Derived from the cited list prices. Excludes storage, data transfer, engineers and the platform itself, which all push the break-even higher. Try your own numbers in the self-hosting vs Bedrock calculator.

Drawing it

A hybrid architecture in five steps.

The review ends with a diagram anyone in the room can read. Two boxes, the data where it lives, the services you can name, arrows labelled with what they carry, and the reasons under the picture[19].

Five steps: two boxes first, put the data where it lives, only boxes you can name, arrows are data and carry labels, the reasons go under the picture.
Five steps from two empty boxes to a readable hybrid architecture.Source: Linda Mohamed, lecture “Von Managed zu Hybrid: KI-Architekturen”, Hochschule Burgenland, 2026
Architecture review

Get the layer decision in writing.

One workshop with your architects and the data owner. Results you choose, €1,000 each. The standard review includes the layer decision record and the cost and break-even sheet.

AI architecture layers review

Intake, a 3 to 4-hour workshop, written results within 5 business days.

Workshop
€2,000 each, 3 to 4 hours, remote or on-site
1
Written results€1,000 per result
€1,000
€1,000
€1,000
€1,000
€1,000
Your package
€4,000


Delivered within 5 business days after the last session.

Book a free 30-min Idea Call15-min question slot
Standard

Layers review

€4,0001 workshop + 2 results
Hybrid

Layers review + diagram

€5,0001 workshop + 3 results
Ongoing

Architecture advisory

on requestMonthly or quarterly reviews
AWS services

The AWS services behind this work.

Plain-language notes on the services I use for this kind of project. Each name links to the official AWS documentation.

Amazon Textract

Reads text, forms and tables from scanned documents and returns them as structured data.

Amazon Bedrock

Managed access to foundation models from several providers through one API. You choose the model and write the prompt; AWS runs the model.

Amazon Bedrock AgentCore

Runtime, memory, identity and tool gateway for AI agents built with any framework, such as Strands or CrewAI.

Amazon SageMaker AI

Managed platform for the whole machine learning lifecycle: notebooks, training jobs, model registry and endpoints.

Red Hat OpenShift Service on AWS (ROSA)

Managed OpenShift clusters in your AWS account. The base for running OpenShift AI next to other AWS services.

Amazon EC2 G6e instances

GPU instances with NVIDIA L40S cards for self-hosted inference, for example with vLLM.

AWS Outposts

AWS-managed racks in your own data centre for workloads that must stay on site.

Amazon FSx for NetApp ONTAP

Managed NetApp file storage on AWS. With S3 access points it bridges on-premises file shares and cloud AI services.

Questions

What people ask before booking.

What is the difference between Amazon Bedrock and SageMaker AI?

Bedrock is a managed model service: you call foundation models through one API and configure prompts, retrieval, guardrails and agents. SageMaker AI is a managed ML platform: you bring data and code, run training jobs and host your own model endpoints.

When should we run Red Hat OpenShift AI instead?

When a constraint requires you to hold the platform: data that may not leave the building, the same platform across cloud and on-premises, or full control of the model runtime. It needs a team that can run OpenShift and GPUs.

Is self-hosting an open model cheaper than Bedrock?

Only at high, steady utilisation. For Llama 3.1 8B on one g6e.xlarge the list-price break-even is about 6.18 billion tokens a month, before engineering and platform costs. Most workloads are far below that.

Can Bedrock run on premises?

No. Bedrock is a Regional service and does not install on AWS Outposts. For on-premises inference you run a model yourself, for example with vLLM on OpenShift AI, and route requests by data class.

What does the architecture review cost?

€2,000 for the workshop plus €1,000 per written result. The standard review with layer decision record and break-even sheet is €4,000 net.

Linda Mohamed, AWS Community Hero, AI and cloud architect in Vienna
Who runs it

Linda Mohamed

AWS Community HeroAWS User Group Vienna organiserLecturer, Hochschule BurgenlandAmazon Bedrock · SageMaker AI · OpenShift AIEN & DE

I teach this map in the master course “Von Managed zu Hybrid: KI-Architekturen” at Hochschule Burgenland and use it in client reviews on AWS and Red Hat platforms. AWS Community Hero, organiser of the AWS User Group Vienna, maintainer of ai-solutions.wiki. Based in Vienna, remote across Europe, English or German.

Projects, open source and talks →

Start here

Start with one conversation.

30 minutes to look at your idea, your data and the right starting point. Or book 15 minutes if you only have a question.

  • Which layer your use case needs
  • Where your data may go
  • Whether hybrid routing is worth it
  • What the review would cover

Vienna, Austria · remote across Europe · [email protected]