Quick wins for a faster PC:
Repair Windows errors before they cause bigger problemsFix Now →Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →Security and compliance for AI systems on AWS depend on the entire workload—its users, data flows, model choices, integrations, and operations—not just the cloud service hosting a model. AWS protects the infrastructure of the cloud; customers are responsible for security in the cloud according to their service choices, data sensitivity, requirements, and applicable law. As Amazon Bedrock’s documentation puts it, “Security is a shared responsibility between AWS and you.”
This guide sets out a practical baseline for AWS AI and machine-learning workloads, including generative AI. Bedrock-specific capabilities are identified as such; they should not be assumed to apply to every AWS AI service.
As an Amazon Associate I earn from qualifying purchases.
Scope the workload before choosing controls
Start by mapping what the AI system does and what could go wrong. AWS Prescriptive Guidance and the AWS AI Security Scoping Matrix emphasize that control depth depends on the application’s exposure, data sensitivity, customization, and business criticality. Revisit the scope when the model, data, users, integrations, or deployment changes.
- Exposure: Is access internal, limited to partners, or public?
- Data: Does the system handle public, internal, confidential, personal, regulated, or proprietary information?
- Model path: Is it using pretrained inference, retrieval-augmented generation (RAG), fine-tuning, or another form of customization?
- Authorization: Do answers draw on sources with different per-user access permissions?
- Impact: What are the consequences of inaccurate, unavailable, manipulated, or disclosed output?
- Obligations and operations: Which geographies, sector rules, contracts, internal policies, evidence needs, monitoring, and incident-response capabilities apply?
Inventory the models and AWS services, invoking users and systems, data sources and destinations, external integrations, deployment geography, and any customization. This gives security, product, and compliance owners a common description of the system to assess.
#1 Best Overall
Set governance and ownership
Assign responsibility for model selection, data-use approval, production releases, guardrail configuration, incident review, and acceptance of residual risk. Document permitted use cases, data classifications, evaluation criteria, expectations for reviewing outputs, and escalation routes. AWS’s generative AI security guidance recommends policies for model access and use, regular security assessments and compliance audits, and documentation of controls.
For evidence management, AWS Audit Manager’s Generative AI Best Practices Framework v2 can help organize evidence around areas such as governance, privacy, accuracy, security, and resilience in supported Bedrock and SageMaker AI contexts. Evidence mapped to a framework can support assurance work; it does not certify that a particular application is compliant.
Apply least privilege to model access and retrieved data
Use narrowly scoped IAM roles for distinct activities—for example, evaluation, general use, fine-tuned-model use, and specialized access. Restrict permissions to the actions, resources, and conditions each role requires, and review them when teams, models, or workflows change. AWS’s enterprise guidance recommends granular roles rather than broad shared access.
Authorize RAG access before retrieval
In a RAG system, check the requesting user’s permissions against the source data before adding retrieved content to the prompt. The model should receive only material that the user is authorized to see. Otherwise, it may produce a fluent answer that exposes information across an access boundary. AWS’s May 15, 2026 AI Security Framework article specifically identifies this risk.
Control network paths as part of the design
Where suitable, consider private connectivity such as AWS PrivateLink for Bedrock or SageMaker AI invocations. Private connectivity is one network-control layer; it does not replace decisions about ingress, egress, identity, or monitoring.
Protect data throughout its lifecycle
Trace data from collection and preprocessing through retrieval, inference, logging, retention, and deletion. Restrict access to datasets and vector stores, encrypt relevant data at rest and in transit, and minimize personal or proprietary information sent to models. Masking or tokenization can reduce exposure for sensitive fields when the transformed data still supports the task.
AWS describes Bedrock as encrypting data at rest and in transit and supporting customer control of keys through AWS KMS. The precise behavior depends on the deployed service, feature, region, and configuration, so verify the current documentation for the workload rather than generalizing this Bedrock description to all AWS AI services.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
Make a deliberate choice about invocation logs
AWS describes optional storage of Bedrock invocation metadata, requests, and responses in S3 or CloudWatch Logs. Logs can assist operations, investigations, and audit evidence, but prompts and outputs may themselves contain sensitive data. Decide what to capture, who may read it, how it is encrypted, and how long it is retained. Set access and retention controls before enabling logging, and account for the impact of logged content on data-handling obligations.
Validate inputs and outputs in layers
Validate data before inference and generated content before it reaches users or downstream systems. Consider prompt injection, attempts to extract data, harmful or disallowed content, output integrity, and application-specific rules. Add monitoring and human review where the consequences of an output warrant it.
Rank #4
For supported Bedrock use cases, Guardrails can be configured to filter inputs and outputs, including harmful categories and restricted topics. Treat this as one configurable layer in a defense-in-depth design—not a complete defense. Keep authorization and application-specific validation in place, and test the configuration against the workload’s threat model and intended behavior.
Monitor, investigate, and preserve evidence
Use CloudTrail to track API activity. Where useful, CloudWatch metrics and dashboards, together with configured invocation logging, can support operational monitoring and audit. Protect access to logs, and apply appropriate encryption and retention controls. Audit Manager’s framework can help organize evidence mapped to recommended practices, but teams remain responsible for deciding what evidence their obligations require.
Define response procedures for unexpected disclosure, prompt attacks, policy violations, model changes, and anomalous access. Assign response owners and specify how to contain the affected path, preserve relevant evidence, notify stakeholders when required, and update controls. AWS’s framework examples include procedures for inadvertent PII disclosure and real-time anomaly monitoring.
Best Value
Map controls to actual compliance obligations
Identify the laws, standards, contracts, data-location requirements, and internal rules that apply to the specific use case. AWS states that Bedrock is in scope for several named compliance programs and is HIPAA eligible; that service-level status does not establish that a customer’s end-to-end application meets every obligation. Confirm current scope and geography in AWS compliance documentation, then assess customer-controlled parts of the architecture.
For personal data, AWS’s security guidance advises data minimization and review of privacy risks with legal counsel or a Data Protection Officer. Whether a processing activity meets a legal requirement depends on jurisdiction and context; do not infer a legal conclusion from a service’s eligibility alone.
Match control depth to workload risk
Use the workload assessment to determine how much validation, access control, monitoring, review, and evidence collection are appropriate. The examples below are a decision aid, not a universal AWS control prescription.
The Tool Desk
Outbyte PC Repair FREERepair Windows errors before they cause bigger problemsFix Now →Outbyte Driver Updater FREEScan for outdated or missing drivers - takes under a minuteDriver Scan →| Workload characteristic | Security question | What to address |
|---|---|---|
| Internal, low-sensitivity use | Who can invoke the system, and what data can it reach? | Scope IAM access, classify permitted inputs, validate outputs for the intended use, and establish operational monitoring. |
| Public- or partner-facing access | Can an untrusted user manipulate inputs or reach an unintended function? | Constrain access and network paths, validate inputs and outputs, monitor anomalous activity, and define incident procedures. |
| Confidential, personal, or regulated data | Where does data flow, persist, and appear in logs? | Minimize sensitive inputs, restrict dataset and log access, decide whether invocation logging is appropriate, and map controls to applicable obligations. |
| RAG with per-user permissions | Can retrieval return content the requester is not allowed to see? | Enforce authorization against source data before retrieved content enters the prompt; test access boundaries. |
| Customized models or high-impact decisions | What changes can affect behavior, and what happens if outputs are wrong? | Govern model changes and releases, set evaluation and review expectations, monitor behavior, and define escalation and containment paths. |
These controls should be selected for the actual architecture and obligations. A public interface, sensitive data, complex per-user authorization, high-impact outputs, or limited response maturity generally calls for closer scrutiny than a low-impact internal use case, but the appropriate design remains workload-specific.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
