Migrating agents from GPT-5.6 Terra to GPT-6.1 Terra on Bedrock

Posted on Oct 27 • Originally published at fernando.moretes.com

The GPT-6.1 Terra announcement on Amazon Bedrock, on 10/26/2026, sells the switch as obvious: 15 percentage points above GPT-5.6 Terra on OpenAI's Agents' Last Exam and token prices at least 50% lower. The question I care about is not whether the new model is better, it's what breaks in your AWS account the day you change the model ID. I read the model card line by line against the 5.6 Terra card, and the answer has names: source Region, API choice, caching and quota. This is the path I would follow to migrate a production agent without learning any of that on call.

The scenario I use as a reference is common in financial environments: an internal agent that reads policies, queries two or three systems through tool-use and returns structured JSON to a Step Functions workflow. It runs on bedrock-runtime with the us.openai.gpt-5.6-terra profile, because the risk team does not accept global routing, and the US geographic profile, sourced from N. Virginia, stays within us-east-1, us-east-2 and us-west-2.

A typical run has about 40 thousand input tokens, 30 thousand of which are a stable prefix (instructions, tool definitions, policy excerpts), and 3 thousand output tokens. At 5.6 Terra list price on US CRIS (US$ 2.20 per million input, US$ 0.22 per million cache read and US$ 13.20 per million output), that run costs roughly US$ 0.068 in steady state. It looks small until you multiply by 200 thousand runs a month: about US$ 13.6 thousand in inference alone.

These numbers are arithmetic on published prices, not customer measurements. They exist to size the decision. What actually matters is the calendar: the 5.6 Terra model card guarantees EOL no sooner than 07/13/2027, with a legacy period of at least six months. There is time, but there is no slack for a rushed migration in the last quarter, which is exactly when the team is busy with something else.

The announcement talks about capability, speed and price. The model card talks about operations, and that is where the migration risk lives. Reading both cards side by side, four differences change the design.

Region on bedrock-mantle: 5.6 Terra runs in-Region on the bedrock-mantle endpoint in us-east-1, us-east-2, us-west-2 and both GovCloud Regions. 6.1 Terra, at launch, only in us-east-1. If you point the OpenAI SDK at bedrock-mantle.us-west-2.api.aws, you don't migrate by changing a string.

Source Region on bedrock-runtime: the 6.1 Terra table does not list sa-east-1 or me-central-1 as a source for the global profile, and it does not include the in. geographic profile that 5.6 Terra offers for Mumbai and Hyderabad. If you call from São Paulo, this decides where the workload's client has to run.

Invoke API: the 6.1 Terra API table marks InvokeModel as supported on bedrock-runtime; the 5.6 Terra table marks it as unsupported. That helps teams with legacy Invoke code, but it doesn't change the Guardrails and application inference profile restrictions, which remain tied to Converse.

Service tiers: Standard only. No Priority, Flex or Reserved. If your capacity plan depended on reserving throughput, it does not exist for this model today.

None of this is in the What's New post. An announcement is a trigger; the operational contract lives in the documentation.

Inventory how the model is called today: Before touching code, pull four facts per application from invocation logs and CloudTrail: endpoint ( bedrock-runtime or bedrock-mantle ), API (Converse, Responses, Chat Completions), source Region and input size distribution. CloudTrail's additionalEventData.inferenceRegion field, logged in the source Region, shows where each request was actually processed. Count how many requests exceed 272 thousand tokens: they move to a different price band.

Prepare IAM and SCPs before the first request: The model card requires bedrock:InvokeModel on the account's default project ( arn:aws:bedrock:{region}:{account-id}:project/default ) in addition to the inference profile. Missing it produces an AccessDeniedException that looks like a credentials bug. For a geographic profile, the SCP must allow every destination Region in the profile; for a global profile, it must allow aws:RequestedRegion equal to unspecified, which many landing zones block by default.

Evaluate offline with real traffic: Replay 300 to 500 logged, already sanitized runs against us.openai.gpt-6.1-terra. Compare three signals per task: valid JSON rate against the schema with strict: true, correctness of tool choice and arguments, and output tokens per task. OpenAI's benchmark is a hypothesis; your workload is the proof.

Reposition the cache: On Responses, mark the end of the stable prefix with prompt_cache_breakpoint and use prompt_cache_options.mode: explicit so the automatic breakpoint doesn't consume the four writes per request. The minimum prefix is 1,024 tokens and the TTL is 30 minutes. Track cached_tokens against cache_write_tokens: writes cost 1.25x uncached input.

Canary with a written promotion criterion: Split traffic by flag (5%, 25%, 100%), with the model ID coming from configuration, not code. Write down beforehand what promotes and what rolls back: schema failures no higher than baseline, equal or lower p95 latency, cost per run and InvocationThrottles within budget. A criterion decided after the result is rationalization.

Retire the old path on purpose: Keep the 5.6 Terra profile as rollback for 30 days after reaching 100%. Then remove it from the IAM policy. A forgotten permission becomes an escape hatch: someone falls back to the old model in a hotfix and nobody notices until the invoice.

On bedrock-runtime, the 6.1 Terra model card ties features to different APIs, and they don't add up. Guardrails only work through Converse. Application inference profiles, which is how you attribute cost per team with tags, are also Converse only. Explicit caching, on the other hand, only exists on Responses. On Converse you get implicit caching, which the documentation itself calls best effort.

Converse has two more restrictions: it doesn't accept document blocks, and it rejects an image inside toolResult with a ValidationException. An agent that returns a tool screenshot to the model breaks on the first call.

The cost of this choice can be calculated. In the reference scenario, the 30-thousand-token prefix costs US$ 0.033 uncached and US$ 0.00165 as a cache read, at US$ 1.10 and US$ 0.055 per million. Every miss costs 20 times more on the prefix. If implicit caching hits 60% and explicit hits 95%, the gap across 200 thousand runs a month is close to US$ 2.2 thousand.

Use Converse when AWS Guardrails and cost allocation by application profile are audit requirements, and measure the real hit rate through cacheReadInputTokens before accepting the loss. Use Responses when the prefix is large and stable and content filtering already happens in another layer you control. Running half the fleet on each API without deciding is the worst case: two audit trails, two cost models.

The diagram answers one question: where control of the model switch lives. The router reads the model ID from a flag and splits traffic between the two US CRIS profiles. Dashed arrows are asynchronous: invocation logs arrive later, and promotion is a human decision based on the harness, not an automatic trigger. IAM, SCPs and the profile's destination Regions are simplified away.

The price cut is the easy part. Quota is what sinks the migration. On bedrock-runtime, limits are measured in tokens per minute with a 10x burndown on output: each output token consumes 10 from quota. Tokens read from cache don't count toward the input quota. In the reference scenario, one run consumes 10 thousand uncached input tokens plus 30 thousand output-equivalent tokens. Three quarters of the quota goes to output.

This creates a silent failure mode. If the new model answers with 20% more output tokens, because it reasons more or writes more, cost still drops substantially and no FinOps alarm fires. Quota, however, rises 15% per run, and the first signal is a ThrottlingException at the morning peak. That's why the canary watches OutputTokenCount and InvocationThrottles in CloudWatch, not just the invoice.

The second late cost is long context. 6.1 Terra accepts a 1,050,000-token context (OpenAI's page states 922 thousand maximum input), but above 272 thousand input tokens the whole request moves to another band: input at US$ 2.20 and output at US$ 8.25 per million on US CRIS. An agent that accumulates history without summarizing crosses that line around turn twenty and doubles the input cost of every call from then on. Set an explicit history ceiling, around 250 thousand tokens, and summarize above it. Having a 1-million-token context doesn't oblige anyone to use 1 million.

Risks I would handle before the canary: São Paulo as source: the 6.1 Terra table doesn't list sa-east-1 as a global profile source; if you call from there, move the client or wait. GovCloud and bedrock-mantle outside us-east-1: no path at launch. Longer output: with a 10x burndown, 20% more output becomes 15% more quota per run in the reference scenario, with no cost alarm. The 272-thousand-token line: cross it and the whole request pays the long-context band. Vendor benchmark: the 15 points and "three times faster" come from OpenAI's Agents' Last Exam, not from your workload.

Curator's note: I would start this migration in November, not in June 2027. The first week would go entirely to the inventory and to the Converse versus Responses decision, because that decision defines auditing, caching and cost attribution for the next two years. After 16 years operating financial platforms, the lesson that keeps repeating in dependency swaps is this: the cost of a migration is not swapping the component, it's discovering late the contract that changed with it. With language models that doubles, because behavior changes too and no unit test catches it.

Migrate, and start now. Use GPT-6.1 Terra when your workload runs on bedrock-runtime with a us. or global. profile from a source Region listed in the model card, when replaying real traffic shows equal or better schema and tool-use results, and when quota can absorb the new output under a 10x burndown. Stay on 5.6 Terra for now if you depend on bedrock-mantle outside us-east-1, on GovCloud, or on sa-east-1 as a source with residency requirements; the 07/13/2027 EOL leaves room to wait for the Region table to grow. Either way, decide Converse or Responses before the canary: that is the choice you will maintain, audit and pay for over the next two years.

Rating: Migrar com canário / Migrate with a cana

Originally published at fernando.moretes.com. By Fernando F. Azevedo: Senior Solutions Architect.