Security, Compliance, and Governance for AI
What you will learn
In this domain, you learn the security risks unique to AI systems and the governance needed to control AI as an organization. The goal is to understand attack techniques such as prompt injection, model theft, and data poisoning, along with defensive measures such as IAM, VPC endpoints, Bedrock Guardrails, and SageMaker Role Manager.
Key points
- Prompt injection - an attack that overrides the application's instructions (the system prompt) with directives smuggled into the input, causing unintended behavior. Techniques that aim to bypass the model's own safety policies are called jailbreaking and are treated as distinct
- Data poisoning - an attack that distorts a model's behavior by mixing malicious samples into the training data
- Model theft - an attack that replicates a model by learning its responses through a large number of requests to its API
- Access control for AI services with IAM - manage permissions to use Bedrock and SageMaker under the principle of least privilege
- VPC endpoints and private connectivity - communicate with Bedrock and SageMaker without going out to the internet
- Bedrock Guardrails - a feature that filters inappropriate statements, leakage of personal information, and specific topics
- SageMaker Role Manager - a feature that makes it easy to create IAM roles for SageMaker resources by role
- AI governance - model catalog, auditing of API calls (CloudTrail), recording of input and output content (Bedrock model invocation logging), compliance verification (Audit Manager)
Terms and concepts
Prompt injection
An attack that slips commands such as "ignore the previous instructions" into user input to override the instructions the application has given and cause unintended behavior. Techniques that instead circumvent the model's own safety policies — through role-play, for example — to elicit harmful output that would normally be refused are called jailbreaking; the two are distinguished by what they break through. Both are addressed by defense in depth: Bedrock Guardrails, input filtering, strengthening the system prompt, and output validation.
Data poisoning
An attack that intentionally mixes harmful samples into the training data to distort a model's predictions. For example, if spam is labeled as "legitimate" and mixed into the training data of a spam email classifier, the model will become one that misses real spam. It is addressed by validating data sources, reviewing the training data, and managing data lineage.
Using Bedrock Guardrails
Guardrails is a safety filter for generative AI on Bedrock. You can configure topic restrictions (e.g., prohibiting discussion of competitor products), content filters (violence, sexual content), personal information masking (automatic masking of PII), and word restrictions (company-confidential words). It is also effective against prompt injection.
Private connectivity with VPC endpoints
A configuration that confines communication to AWS AI services such as Bedrock and SageMaker within a private network via VPC endpoints (PrivateLink). Because it avoids going out to the internet, it lowers the risk of data leakage and makes it easier to meet a company's compliance requirements.
Auditing and governance of AI usage
API calls to Bedrock and SageMaker are recorded in CloudTrail, so you can later audit who invoked which model and when. Note, however, that CloudTrail captures only the metadata of API calls; the content of prompts and responses is not included. If you want to audit the content as well, enable Bedrock model invocation logging — which is disabled by default — and output the logs to CloudWatch Logs or S3. In addition, using AWS Audit Manager, you can continuously assess your compliance status against internal policies or industry standards (HIPAA, PCI DSS, etc.).
Check your understanding
Check what you have learned with 5 questions