Superblocks and AWS: AI apps that run in your own VPC
AWS is embedding Superblocks' vibe-coding platform inside customer VPCs, with Aurora and Bedrock in your own account. The deployment model is the news, not the AI.
AWS and Superblocks announced a multi-year collaboration that puts an AI app builder inside the customer's own VPC. The vibe-coding part is not the interesting part — every vendor has that now. The interesting part is that the generated apps run on your infrastructure, against your database, in your AWS account. That's a deployment model, and it's the one question worth asking every AI vendor you talk to.
What actually happened
TechCrunch reported the deal on August 3: a multi-year joint marketing agreement letting AWS customers run Superblocks embedded in their private clouds. Per the companies' announcement, the shape is:
- Cloud-Prem deployment. The platform runs in the customer's own AWS environment rather than Superblocks' SaaS.
- Amazon Aurora per app. Apps built by business users spin up their own Aurora database inside that account.
- Amazon Bedrock for inference. Model calls go through Bedrock, not straight out to a model vendor's endpoint.
- Smart Router. Superblocks routes each task to a cheaper model where it can, claiming up to 30% savings — that's the vendor's number, not a measured one.
- Sold through AWS Marketplace, so it lands on an existing AWS bill.
Superblocks CEO Brad Menezes framed it plainly to TechCrunch: bring the tool to the data inside the private cloud, and the data never leaves. The company runs about 50 people on roughly $60 million raised, per the same report.
Why running AI apps in your own VPC matters for your business
Most AI app builders are SaaS. That means your schema, your rows, your prompts, and often your customers' names transit a vendor you signed up for in ten minutes. Nobody notices until an auditor, an enterprise customer, or a breach notification asks where the data went. We covered what that costs when the controls are missing last week: 92% of AI-breached organizations had no access controls on the AI at all.
You probably don't have an enterprise AWS estate. The pattern still applies. Three questions, every vendor, every time:
- Where does inference run? A vendor calling Bedrock in your account is a different risk profile from one posting your records to an endpoint you can't see.
- Where does the app's data live? "We don't train on your data" is a policy. A database in your own account is an architecture.
- What do you keep if you cancel? Ask for the app definitions, the schema, and an export. If the answer is a support ticket, you're renting.
One caution: this trades one dependency for another. Cloud-Prem on AWS means AWS-shaped rails — Aurora, Bedrock, Marketplace billing. That's a better trade than a black-box SaaS, but it is still a trade. Price the exit before you sign, not after.
Key takeaways
- AWS and Superblocks will run AI-generated internal apps inside the customer's own VPC, with Aurora databases and Bedrock inference in that account
- The deployment model matters more than the AI: data stays in infrastructure you control, and the model layer stays swappable behind Bedrock
- The 30% cost-saving claim from model routing is a vendor figure — measure your own cost per task before believing it
- Ask any AI vendor where inference runs, where the data lives, and what you keep on cancellation
Running AI on infrastructure you own isn't an enterprise-only option. We build vendor-agnostic automation that lives in your accounts, with the model layer behind a swap point — see how we scope it.
Sources: TechCrunch, Superblocks and AWS announcement.
- #aws
- #vibe-coding
- #private-cloud
- #bedrock
- #internal-tools
Tommy Rush — Founder, Rush Commerce
Operator turned builder. 15+ years running operations — now shipping the systems businesses run on. More
Get The Rush Report weekly — one email, zero fluff.
Keep reading
TLS 1.2 is frozen: post-quantum ships only in TLS 1.3
The IETF published RFC 9851 putting TLS 1.2 in feature freeze. Post-quantum crypto will never be specified for it. Here's how to find what in your stack is stuck.
Read itNext.js security releases now ship on a schedule
Next.js moved to preannounced monthly security releases. Nine CVEs landed July 20 in 16.2.11 and 15.5.21. Why a predictable patch window changes your ops.
Read it