What's changed: In-scope coverage: added security (Macie/Inspector/Secrets Manager) to Ch4 §2 and governance/compliance/cost (CloudWatch/Config/Artifact/Audit Manager/Trusted Advisor/Well-Architected Tool/Cost Explorer/Budgets) to Ch4 §3
4.2Security for AI Solutions
Understand securing AI solutions with IAM least privilege, data encryption and privacy, and Amazon Bedrock Guardrails.
When using AI, basic security still matters—access control, encryption, and suppressing harmful output. AWS provides mechanisms for these.
4.2.1Securing AI
- IAM & least privilege: restrict who/what (people/apps) can access models/data to the minimum needed.
- Encryption & privacy: encrypt data at rest/in transit (e.g., AWS KMS keys) and protect PII; also avoid putting secrets in prompts.
- Amazon Bedrock Guardrails: filter inappropriate/harmful input/output and off-topic responses for safe use.
Using AI does not change cloud security fundamentals. It is layered: restrict who can use models/data with IAM least privilege, protect the data itself with encryption (KMS), and curb generative-AI-specific harmful output with Guardrails. Crucially, the shared responsibility model applies to AI too—AWS protects the platform, but data classification, access management, and prompt handling remain the customer’s responsibility. The Zero Trust and shared-responsibility ideas from earlier chapters apply directly to AI solutions.
Continue reading — free sign-up
You're reading the free preview. Sign up free to read this section in full, plus every chapter (including 4+) and all questions.