This domain is 14% of the scored exam. It is the AWS security basics you already know (IAM, encryption, shared responsibility) applied to AI workloads, plus governance tooling and frameworks. Questions ask which service protects, records, audits or proves compliance.
Shared responsibility for AI
AWS secures the cloud infrastructure and the managed service platform. You secure what you put in and how you use it.
| Service type | AWS handles | You handle |
|---|---|---|
| Bedrock and other managed AI services | Infrastructure, model hosting, service security | IAM permissions, your data, prompts and outputs, guardrails, application security, logging |
| SageMaker / self-hosted models | Hardware, the underlying service | Plus the OS and container images you bring, endpoint config, network isolation, patching your code |
Bedrock doesn’t use your prompts or completions to train the base models, and your data is not shared with model providers. Customisation produces a private copy of the model only you can use.
Securing AI systems
Identity and access
- IAM roles, policies and permissions: grant least privilege. Separate who can invoke a model (
bedrock:InvokeModel) from who can manage or customise models. Restrict access to specific model ARNs. - Use roles, not long-lived access keys. Service roles let Bedrock read your S3 data for Knowledge Bases or fine-tuning.
- Models in Bedrock must be enabled for use; control who can use them with IAM and service control policies (SCPs).
- Resource policies and condition keys restrict by VPC endpoint, Region or tag.
Encryption
| Where | How |
|---|---|
| At rest | AWS KMS keys (AWS managed or customer managed keys) for S3 training data, custom models, Knowledge Base stores, SageMaker volumes, and agent sessions |
| In transit | TLS for all API calls |
| Secrets | Store credentials and API keys in AWS Secrets Manager, never in prompts or code |
Network isolation
- AWS PrivateLink (interface VPC endpoints) lets your VPC reach Bedrock and other AWS services privately, without traversing the public internet.
- Amazon VPC with private subnets and security groups for SageMaker training and endpoints; network isolation mode stops containers calling out.
Data discovery and protection
- Amazon Macie uses ML to find and report sensitive data such as PII in S3. Run it on buckets that hold training or RAG data before using them.
- Bedrock Guardrails filter PII at inference time.
- Amazon Comprehend can detect and redact PII in text.
Monitoring and threat detection
- AWS CloudTrail records API calls (who invoked or changed what).
- Amazon CloudWatch monitors metrics and logs. Bedrock model invocation logging can send prompts and responses to CloudWatch Logs or S3 for audit.
- Amazon Inspector scans EC2, container images and Lambda for vulnerabilities.
- AWS Trusted Advisor checks against best practices.
- (GuardDuty, Security Hub and similar are outside the exam’s scope.)
Source citation and documenting data origins
Being able to say where data came from and how it changed supports trust, compliance and debugging.
| Concept | Meaning | Tools |
|---|---|---|
| Source citation | A generated answer points to the documents it used (a RAG strength) | Bedrock Knowledge Bases citations |
| Data lineage | Tracks the origin and every transformation of data | SageMaker ML Lineage Tracking, AWS Glue |
| Data cataloging | An organised inventory of datasets and metadata | AWS Glue Data Catalog, AWS Lake Formation, SageMaker Catalog |
| Model documentation | Records purpose, data, metrics and limits | SageMaker Model Cards |
| Dataset provenance and licence | Where it came from and the right to use it | Data Exchange terms, internal records |
Secure data engineering
| Practice | Detail |
|---|---|
| Assess data quality | Completeness, accuracy, consistency, timeliness; AWS Glue Data Quality and DataBrew rules |
| Privacy-enhancing technologies | Anonymisation, pseudonymisation, tokenisation, masking, differential privacy (adds noise so individuals can’t be identified), encryption, and federated learning |
| Data access control | Least privilege through IAM, Lake Formation fine-grained permissions (column, row), S3 bucket policies and Block Public Access |
| Data integrity | Prevent unauthorised change: versioning, checksums, immutable logs, S3 Object Lock |
| Data minimisation and retention | Collect only what’s needed; delete when no longer required |
Poisoned or tampered training data is an integrity risk, so control who can write to training buckets.
Security and privacy considerations specific to AI
| Threat | Description | Defence |
|---|---|---|
| Prompt injection | Untrusted text (user input, web page, document) tricks the model into ignoring its instructions or leaking data or calling tools | Guardrails prompt-attack filter, separate instructions from data, least privilege for agents, human approval for risky actions |
| Jailbreak | Attempts to bypass safety rules | Guardrails, red-teaming |
| Data poisoning | Corrupted training or retrieval data | Provenance checks, access control, validation |
| Sensitive data leakage | The model reveals training data or PII | Remove PII from data, Guardrails masking, output filtering |
| Model theft / inversion | Extraction of model or data | Access control, rate limits, monitoring |
| Excessive agency | An agent has too many permissions | Narrow IAM roles on action groups |
| Insecure application | Ordinary web vulnerabilities | Application security: validation, authentication, WAF, patching |
Also apply standard practices: vulnerability management (Inspector), infrastructure protection (VPC, security groups), threat detection and monitoring, encryption at rest and in transit, and secure development.
Governance and compliance
Regulatory standards
| Standard or law | What it covers |
|---|---|
| ISO (for example ISO/IEC 27001 security, ISO/IEC 42001 AI management systems, ISO/IEC 27701 privacy) | International management-system standards |
| SOC 1/2/3 | Audit reports on controls over security, availability, confidentiality, privacy |
| GDPR | EU personal-data protection |
| HIPAA | US health data |
| PCI DSS | Payment card data |
| EU AI Act, algorithm accountability laws | Rules on risk categories, transparency and bias auditing of AI |
| NIST AI Risk Management Framework | Voluntary US framework for managing AI risk |
You don’t need legal detail, only to know that AI is subject to rules and that compliance depends on the use case and Region.
AWS services that help
| Service | Role |
|---|---|
| AWS Artifact | On-demand portal for AWS compliance reports (SOC, ISO) and agreements |
| AWS Audit Manager | Continuously collects evidence and builds audit reports; includes a generative AI best-practices framework |
| AWS Config | Records resource configuration and checks it against rules (for example “S3 bucket is encrypted”) |
| AWS CloudTrail | Records account activity for auditing |
| Amazon Inspector | Vulnerability management |
| AWS Trusted Advisor | Best-practice checks (security, cost, limits) |
| AWS Well-Architected Tool | Review workloads, including the Generative AI Lens |
| Amazon Macie | Sensitive-data discovery |
| AWS KMS | Key management and key usage audit |
| SageMaker Model Cards / Model Dashboard | Governance records for models |
Quick mapping: prove compliance to an auditor goes to Artifact (AWS’s reports) or Audit Manager (your evidence); who did what is CloudTrail; is configuration compliant is Config; find PII is Macie; scan for vulnerabilities is Inspector.
Data governance strategies
- Data lifecycle management: define stages from collection to deletion.
- Logging and monitoring: keep audit trails of data and model access.
- Residency: keep data in required Regions; enable only the Regions you need and be careful with cross-Region inference.
- Retention: keep data for as long as required (S3 lifecycle, Glacier) and no longer.
- Observation: continuous monitoring of model behaviour and data quality.
- Classification: label data by sensitivity.
Governance protocols and frameworks
| Element | Detail |
|---|---|
| Policies | Written rules for acceptable use, data handling, and approved models |
| Review cadence | Regular, scheduled reviews of models, data and risks |
| Review strategies | Technical, legal and ethics reviews; an AI governance board or committee |
| Transparency standards | Document use of AI; model and service cards; tell users when they’re talking to AI |
| Team training | Train staff on responsible and secure AI use |
| Generative AI Security Scoping Matrix | AWS framework that sorts generative AI use into five scopes by how much you own, and shows which security disciplines apply at each |
Generative AI Security Scoping Matrix scopes (increasing ownership and responsibility):
- Consumer app: using a public generative AI service (for example a public chatbot).
- Enterprise app: a third-party SaaS with generative AI features (for example Amazon Q Business).
- Pre-trained models: you build your app on a foundation model through an API (Bedrock).
- Fine-tuned models: you customise a model with your data.
- Self-trained models: you build and train the model from scratch.
The more scope you own, the more of the security (data governance, legal, risk, controls, resilience) is yours.
Common traps
- Bedrock does not train base models on your prompts. Don’t choose “opt out of sharing” as the answer unless that’s the stated issue.
- PrivateLink keeps traffic off the public internet; KMS encrypts data; IAM controls who can act. Don’t mix them up.
- Artifact is AWS’s compliance documentation; Audit Manager is your own audit evidence.
- Macie is for S3 data discovery; it does not scan prompts at inference time (use Guardrails).
- Prompt injection is an application-level threat; patch-level tools like Inspector don’t address it.
Exam checklist
- State the shared responsibility split for Bedrock versus a self-hosted SageMaker model.
- Choose among IAM, KMS, PrivateLink, Secrets Manager and Macie for a requirement.
- Define data lineage, cataloguing and source citation and name the tools.
- List privacy-enhancing technologies and data integrity controls.
- Describe prompt injection, jailbreak, poisoning and leakage with a defence each.
- Match Artifact, Audit Manager, Config, CloudTrail, Inspector, Trusted Advisor and Macie to jobs.
- Name the five scopes of the Generative AI Security Scoping Matrix.
- List data governance strategies (lifecycle, logging, residency, retention, monitoring).