Bedrock vs Azure Foundry vs Vertex AI (2026): Models, Pricing, Agents

Every quarter someone asks me which cloud they should run their LLM workloads on, and every quarter the honest answer gets a little more boring: the one your identity, network and billing already live in, unless a specific model or a residency rule forces your hand. This post is the long version of that answer for late 2026. It compares Amazon Bedrock, Microsoft Foundry (the product most people still search for as Azure OpenAI or Azure AI Foundry) and Google's Vertex AI, which Google has folded into the Gemini Enterprise Agent Platform. I cover model catalogs, how each one charges for on-demand and reserved capacity, where your prompts are actually processed, the agent services each cloud now sells, guardrails, and when you should skip all three and call a model vendor directly. If you want to build something on Bedrock straight after reading, the companion guide How to Build RAG With Amazon Bedrock Knowledge Bases walks through a full knowledge base with boto3.

First, the names changed (again)

Two of the three products renamed themselves in the last twelve months, which matters if you are reading older blog posts or Terraform modules.

Microsoft's own docs now describe Microsoft Foundry as the successor to "Azure AI Studio / Azure AI Foundry", with Azure AI Services renamed Foundry Tools. More useful than the brand: the resource model changed. The old hub plus Azure OpenAI plus Azure AI Services combination is now a single Foundry resource with projects, the agent API moved from the Assistants API to the Responses API (Agents v2), and versioned api-version query strings gave way to stable /openai/v1/ routes. An existing Azure OpenAI resource can be upgraded in place while keeping its endpoint and keys, according to the same page.

Google went further. Its release notes record that on 22 April 2026 "Vertex AI is now part of Gemini Enterprise Agent Platform", that Agent Builder became part of the same platform, and that Agent Engine is now called Agent Runtime. The Register's Cloud Next coverage lists the pieces: Agent Studio, the Agent Development Kit, an agent registry, Agent Runtime, Memory Bank, Agent Identity, Agent Gateway and evaluation tooling. According to the release notes, old bookmarked console links redirect, so most existing work carried over; your search results are what broke.

Amazon kept the Bedrock name and bolted AgentCore on beside it. AgentCore went GA on 13 October 2025 and has shipped a steady stream of additions since.

Model catalogs: who has which models in 2026?

This used to be the deciding question. It is less so now, because the big catalogs overlap more than they differ.

Bedrock's models at a glance page lists Anthropic's Claude 5.x family (including Claude Sonnet 5.5, which its model card dates to 28 September 2026), Amazon Nova, Meta Llama, Mistral, DeepSeek, Qwen, Moonshot's Kimi, xAI's Grok 4.7, Google's open Gemma 4 models and, the big change this year, OpenAI's hosted GPT models: GPT-6 Astra, GPT-6.1 Sol and GPT-6.1 Terra. AWS announced GPT-6.1 Sol GA on 29 September 2026. One billing detail worth knowing: the Claude model card says third-party models are billed through AWS Marketplace, so the charge shows under the provider in Cost Explorer rather than under Bedrock.

Foundry claims more than 10,000 models from Microsoft, OpenAI, Anthropic, Meta and others. The headline remains that new OpenAI models land there first, and Microsoft's deployment docs say new models launch on the Global deployment type before Data Zone and regional types.

Google's Model Garden has Gemini, which you cannot get anywhere else as a managed API, plus partner models. The release notes show Claude Haiku 5.5 arriving on 7 October 2026 and Claude Fable 5.2 going GA on 9 November 2026.

So in practice: Claude is on all three, OpenAI's frontier models are on Azure and now Bedrock, and Gemini is Google only. If your product depends on one specific model on day one, check the per-model region table, not the catalog page, because availability by region and by deployment type is where the catalogs really differ.

Pricing: on-demand tiers, batch and provisioned throughput

Per-token prices for the same third-party model tend to track the vendor's own list price across clouds, so the interesting differences are in the tiers and commitments around those prices.

	Amazon Bedrock	Microsoft Foundry	Gemini Enterprise Agent Platform (Vertex AI)
Cheaper, slower on-demand	Flex tier, 50% off Standard (pricing)	Flex processing on Global Standard (docs)	Flex PayGo, 50% off Standard PayGo (docs)
Faster on-demand	Priority tier, 75% premium (pricing)	Priority processing, per-model latency target (docs)	Priority PayGo (docs)
Batch	50% off for some models (pricing)	Global and Data Zone Batch, 50% off, 24-hour target (docs)	Batch inference, 50% off (docs)
Reserved capacity unit	Reserved tier: tokens per minute, min 100,000 input and 10,000 output TPM (docs)	PTUs, model-independent quota (docs)	GSUs, converted per model by a burndown rate (docs)
Commitment terms	Reserved: 1 or 3 months. Provisioned Throughput: none, 1 or 6 months (docs)	Hourly, or Azure Reservations for 1 month or 1 year	1 week (Google models only), 1 month, 3 months, 1 year
Overflow when full	Reserved overflows to Standard	Optional spillover to a standard deployment	Overage billed as Standard PayGo

A few things in that table are traps rather than features.

On Azure, PTU quota is not capacity. Microsoft's provisioned throughput page says plainly that having quota "doesn't guarantee that capacity is available", that reservations do not guarantee capacity either, and that you should create the deployment first and buy the reservation second. Scaling a PTU deployment down releases capacity you may not get back.

On Google, term fees are not cancelable, and the one-week term exists only for Google's own models. On Standard PayGo, Google sets your throughput tier by your organisation's spend over a rolling 30 days: for Gemini Pro-class models that runs from 500,000 TPM at $10 to $250 of spend up to 10 million TPM above $50,000.

On AWS, there are now two reservation products. The older Provisioned Throughput, billed hourly per model unit, is still mandatory for custom (fine-tuned) models, and the cross-Region inference docs note that inference profiles "currently don't support Provisioned Throughput". The newer Reserved tier is sized in tokens per minute and targets 99.5% uptime. If you are trying to cut LLM API costs, Flex at half price is the easiest win on Bedrock for anything that is not user-facing.

Data residency: global, geographic and regional endpoints

All three clouds now push you towards a global routing option by default, and all three sell a narrower option for compliance. The words are different, the shape is the same.

On Bedrock, the cross-Region inference docs give you two kinds of inference profile. Geographic profiles (us., eu. and so on) keep processing inside that geography at standard price; global profiles route to any commercial Region for "approximately 10% savings". CloudTrail logs the call in your source Region with an additionalEventData.inferenceRegion field, which is what an auditor will ask to see. Note that many recent models, Claude Sonnet 5.5 among them, have no in-Region option at all in the US: it is geo or global.

Microsoft's deployment types page is the clearest of the three. Global types may process in any Azure region, Data Zone types stay within the US, EU or APAC zone, and Standard or Regional Provisioned stay in your chosen geography. Data at rest stays in the designated geography for all of them.

Google's data residency page says requests to the global endpoint "don't provide any data residency guarantees", while multi-region and listed regional endpoints keep ML processing in the jurisdiction.

If residency is a hard requirement, enforce it rather than documenting it. On AWS, the global profile only works if your SCPs allow aws:RequestedRegion to be unspecified, which gives you a clean kill switch:

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Sid": "DenyGlobalCrossRegionInference",
      "Effect": "Deny",
      "Action": [
        "bedrock:InvokeModel",
        "bedrock:InvokeModelWithResponseStream"
      ],
      "Resource": "*",
      "Condition": {
        "StringEquals": { "aws:RequestedRegion": "unspecified" }
      }
    }
  ]
}

On Azure the equivalent is an Azure Policy that denies the GlobalStandard SKU, which Microsoft publishes as a sample on the deployment types page. On Google it is an organisation policy on resource locations plus code review that nobody points at the global location.

Agent services: AgentCore vs Foundry Agent Service vs Agent Runtime

All three now sell a managed place to run agent code, plus memory, tool gateways, identity and evaluation. The pricing models are close enough to compare directly.

AgentCore pricing bills Runtime per vCPU-hour and GB-hour: $0.0895 and $0.00945 on the original microVM generation, $0.1276 and $0.0169 on the v2 microVMs, with a committed-baseline discount slated to launch by October 2026. Gateway costs $0.005 per 1,000 API invocations (ListTools, InvokeTool and so on), long-term memory $0.75 per 1,000 records a month, and the Policy service $0.000025 per authorisation request.

Google's price sheet lists Agent Platform Compute at $0.085 per vCPU-hour, Memory at $0.009 per GiB-hour and Storage at $0.30 per GiB-month, replacing the older Agent Engine SKU of $0.0864 per vCPU-hour. On raw compute, the two are within a few percent of each other.

Foundry Agent Service splits agents into prompt agents (configuration only, Foundry runs them), voice-based prompt agents, and hosted agents (your container, your framework, a dedicated Entra identity per agent). Its cost model for hosted agents is inference plus tool usage plus container compute. It also supports A2A v1.0 for agent-to-agent calls, which matters if you are following the agent protocol wars.

My view: the runtime is the least differentiated part. What you are really choosing is the identity system your agents will authenticate with (IAM roles, Entra agent identities, Google's Agent Identity) and where the audit trail lands. Pick the cloud whose identity your security team already knows how to review. I run a microVM platform for agent code myself (PandaStack, which I founded), and the isolation primitive matters far less to most buyers than who can answer "which agent called this API at 3 a.m.".

Guardrails: Bedrock Guardrails, Foundry guardrails and Model Armor

Bedrock Guardrails is a separate, priced product you attach to any model call. Current prices are $0.15 per 1,000 text units for content filters and denied topics, $0.10 for sensitive information filters and contextual grounding checks, and $0.17 per 1,000 text units per policy for Automated Reasoning checks, where a text unit is up to 1,000 characters. Regex and word filters are free. Remember that input and output are both evaluated, so a chatty RAG answer costs more to screen than the question.

Foundry ships content filters and prompt-injection protection, including cross-prompt injection, as part of the platform, configured per deployment or per agent. Google sells Model Armor, which screens prompts and responses and integrates with Agent Platform, MCP servers and Apigee.

None of these is a substitute for least-privilege tools. Even a classifier that caught 95 percent of injections would let the rest reach whatever your agent can call. The prompt injection defence guide covers the layers that matter more.

When should you skip all three and use the model API directly?

Going direct to OpenAI, Anthropic or Google AI Studio still wins in a few cases. Beta features tend to reach the vendor's own API before a cloud reseller; the Bedrock Claude Sonnet 5.5 card, for example, spells out exactly which tool types and beta headers Bedrock supports, and you should diff that list against the vendor's docs before assuming parity. A small team without an enterprise cloud agreement may also find a single vendor bill simpler than a cloud Marketplace line item. And if you need several vendors' models behind one interface, an AI gateway in front of direct APIs can be less work than three cloud integrations.

The cloud route wins when you need private networking, an existing enterprise discount, a BAA or data processing terms you have already signed, residency enforcement through policy, or consolidated billing that finance will actually approve. For most companies past the seed stage, those reasons dominate.

FAQ

Is Vertex AI discontinued?

No. Google renamed and expanded it: on 22 April 2026 Vertex AI became part of the Gemini Enterprise Agent Platform, and Agent Engine was renamed Agent Runtime. Google says bookmarked console links redirect to the new pages.

Is Azure OpenAI the same as Microsoft Foundry?

Azure OpenAI models are now one part of Microsoft Foundry, which also hosts models from Anthropic, Meta and others under a single Foundry resource. You can upgrade an existing Azure OpenAI resource to a Foundry resource and keep your endpoint and keys.

Which is cheapest: Bedrock, Foundry or Vertex AI?

For the same third-party model, on-demand token prices are usually close. The real differences come from discounts you can use: Bedrock's Flex tier and Google's Flex PayGo are 50 percent off standard rates, batch is 50 percent off on all three for supported models, and Bedrock's global inference profiles are about 10 percent cheaper than geographic ones.

Can I use Claude on all three clouds?

Yes. Claude models are listed on Bedrock, in Microsoft Foundry and in Google's Model Garden. Regional availability and supported features differ by cloud, so check the specific model card before committing.

I would not migrate anything because of this comparison. What I would do this quarter is narrower: turn on Flex or batch for every offline workload on whichever cloud you already use, put an explicit residency control (SCP, Azure Policy or org policy) in front of the global routing options, and if you are starting a RAG project on AWS, build the first version with the Bedrock Knowledge Bases guide before you hand-roll a vector pipeline.

Related: Vector Databases in 2026: Do You Need One, or Is pgvector Enough?, Self-Hosting LLMs vs API Costs in 2026: The 62% Utilisation Break-Even and AI Gateways in 2026: Six Options Compared After LiteLLM's 40-Minute Backdoor.