What's changed: In-scope coverage: added security (Macie/Inspector/Secrets Manager) to Ch4 §2 and governance/compliance/cost (CloudWatch/Config/Artifact/Audit Manager/Trusted Advisor/Well-Architected Tool/Cost Explorer/Budgets) to Ch4 §3
4.2Security for AI Solutions
Understand securing AI solutions with IAM least privilege, data encryption and privacy, and Amazon Bedrock Guardrails.
When using AI, basic security still matters—access control, encryption, and suppressing harmful output. AWS provides mechanisms for these.
4.2.1Securing AI
- IAM & least privilege: restrict who/what (people/apps) can access models/data to the minimum needed.
- Encryption & privacy: encrypt data at rest/in transit (e.g., AWS KMS keys) and protect PII; also avoid putting secrets in prompts.
- Amazon Bedrock Guardrails: filter inappropriate/harmful input/output and off-topic responses for safe use.
Using AI does not change cloud security fundamentals. It is layered: restrict who can use models/data with IAM least privilege, protect the data itself with encryption (KMS), and curb generative-AI-specific harmful output with Guardrails. Crucially, the shared responsibility model applies to AI too—AWS protects the platform, but data classification, access management, and prompt handling remain the customer’s responsibility. The Zero Trust and shared-responsibility ideas from earlier chapters apply directly to AI solutions.
| Protects | Mechanism | Responsible AI link |
|---|---|---|
| Access (who can use) | IAM, least privilege | Privacy |
| Data | Encryption (KMS) | Privacy & safety |
| Output (harmful/off-topic) | Bedrock Guardrails | Safety & robustness |
Scenario: an internal generative AI app. Restrict model invocation to a specific app role via IAM least privilege. Encrypt data with KMS and set a rule against putting customer PII in prompts. Curb harmful or leaky output with Bedrock Guardrails, and have humans review important answers. AWS protects the platform; you manage data and access (shared responsibility).
Watch the mix-ups: (1) access control = IAM/least privilege, data protection = encryption (KMS), suppress harmful output = Bedrock Guardrails—different roles. (2) Guardrails also implement responsible AI (safety). (3) Shared responsibility applies to AI; data and access stay with the customer—not "all handled because it’s cloud/AI."
Q. Guardrails vs IAM? IAM is access control ("who can use models/data"); Guardrails keep generative-AI input/output safe (content filtering). Q. How is encryption done? With AWS KMS keys, at rest and in transit. Q. Does shared responsibility apply to AI? Yes—AWS protects the platform; the customer is responsible for data, access, and prompt handling.
Common: access control = IAM/least privilege, data protection = encryption (KMS), suppress harmful output = Bedrock Guardrails. Shared responsibility applies to AI; data/access management is the customer’s.
4.2.2In-scope security services that protect AI
Beyond IAM, KMS, and Guardrails, AWS security services that protect the AI surroundings are also in scope for AIF-C01. Amazon Macie automatically discovers and classifies whether PII or sensitive data is mixed into training/inference data (it scans S3 with machine learning), serving as a starting point for data governance. Amazon Inspector continuously scans the EC2, container images, and Lambda that run your models for known vulnerabilities. And AWS Secrets Manager safely stores and rotates the API keys and credentials used to call models or external APIs, so you never hard-code them in prompts or code. Distinguish by role: "data contents = Macie / runtime vulnerabilities = Inspector / secret storage = Secrets Manager."
4.2.3Section summary
- Layered security: IAM/least privilege (access), KMS encryption (data), Bedrock Guardrails (output)
- The shared responsibility model applies to AI—data/access are the customer’s
- Surrounding protection = Macie (find PII) / Inspector (vulnerability scan) / Secrets Manager (credential storage)
Sign in to track progress — Log in.
Quick check
(just a quick review)Q1. Which Amazon Bedrock feature filters inappropriate/harmful inputs and outputs?
Q2. Which is used to restrict who can access models/data to the minimum?
Q3. Which is an appropriate basic measure to protect data in AI solutions?
Keep track of your progress
The full study guide is free to read. Sign up free to practice with the question bank, track what you have read, review your mistakes, and highlight passages.