Security, Compliance, and Governance for AI Solutions
What you will learn
In this domain, you learn the security risks unique to AI systems and the governance needed to control AI as an organization. The goal is to understand attack techniques such as prompt injection, model theft, and data poisoning, along with defensive measures such as IAM, VPC endpoints, Bedrock Guardrails, and SageMaker Role Manager.
Key points
- Prompt injection - an attack that overrides the application's instructions (the system prompt) with directives smuggled into the input, causing unintended behavior. Techniques that aim to bypass the model's own safety policies are called jailbreaking and are treated as distinct
- Data poisoning - an attack that distorts a model's behavior by mixing malicious samples into the training data
- Model theft - an attack that replicates a model by learning its responses through a large number of requests to its API
- AI-specific risks - preventing data leakage, filtering and validating output, curbing toxicity, and keeping audit logs of interactions with AI are added to the usual security measures
- Access control for AI services with IAM - manage permissions to use Bedrock and SageMaker under the principle of least privilege
- AgentCore Identity and Policy - Identity handles the identity and credentials an agent uses to access other services on behalf of users, and Policy uses rules to allow or deny tool calls that pass through Gateway
- VPC endpoints and private connectivity - communicate with Bedrock and SageMaker without going out to the internet
- Bedrock Guardrails - a feature that filters inappropriate statements, leakage of personal information, and specific topics
- Detecting hallucinations - reduce incorrect answers, and find and stop them, with grounding that provides evidence through RAG, output validation, and confidence scores
- SageMaker Role Manager - a feature that makes it easy to create IAM roles for SageMaker resources by role
- AI governance - model catalog, auditing of API calls (CloudTrail), recording of input and output content (Bedrock model invocation logging), compliance verification (Audit Manager)
Terms and concepts
Prompt injection
An attack that slips commands such as "ignore the previous instructions" into user input to override the instructions the application has given and cause unintended behavior. Techniques that instead circumvent the model's own safety policies — through role-play, for example — to elicit harmful output that would normally be refused are called jailbreaking; the two are distinguished by what they break through. Both are addressed by defense in depth: Bedrock Guardrails, input filtering, strengthening the system prompt, and output validation.
Data poisoning
An attack that intentionally mixes harmful samples into the training data to distort a model's predictions. For example, if spam is labeled as "legitimate" and mixed into the training data of a spam email classifier, the model will become one that misses real spam. It is addressed by validating data sources, reviewing the training data, and managing data lineage.
AI-specific risks and countermeasures
Generative AI needs AI-specific measures in addition to the usual application defenses (vulnerability management, threat detection, and encryption in transit and at rest). To prevent data leakage, in which personal information or confidential company information gets mixed into answers, narrow the data passed to the model and use Bedrock Guardrails to mask personal information in inputs and outputs. Stop toxic output such as discriminatory expressions or violence with output filters, and validate answers that fall outside a defined format or range of values on the application side before using them. How to keep records of interactions is as described in "Auditing and governance of AI usage."
→ Amazon Bedrock Guardrails Glossary / → Audit Logging with CloudTrail
Using Bedrock Guardrails
Guardrails is a safety filter for generative AI on Bedrock. You can configure topic restrictions (e.g., prohibiting discussion of competitor products), content filters (violence, sexual content), personal information masking (automatic masking of PII), and word restrictions (company-confidential words). It is also effective against prompt injection.
Detecting hallucinations and grounding
Because hallucinations cannot be eliminated completely, you prepare for them both by providing evidence to reduce them and by detecting them in the answers that are produced. Grounding is a method of passing internal documents and other material retrieved with RAG to the model as the basis for its answer and having it answer within that scope. The contextual grounding check in Bedrock Guardrails determines whether an answer is based on the reference source (grounding) and whether it matches the question (relevance). Answers whose grounding and relevance scores fall below the thresholds you set are blocked. Answers with low model confidence scores or that fail format validation are sent for human review, or the system holds back from answering.
→ RAG with Bedrock Knowledge Bases / → Amazon Bedrock Guardrails Glossary
Private connectivity with VPC endpoints
A configuration that confines communication to AWS AI services such as Bedrock and SageMaker within a private network via VPC endpoints (PrivateLink). Because it avoids going out to the internet, it lowers the risk of data leakage and makes it easier to meet a company's compliance requirements.
AgentCore Identity and Policy
Amazon Bedrock AgentCore Identity is identity and credential management dedicated to AI agents. It handles authentication and authorization when an agent accesses AWS resources or external services on behalf of users. Because it can connect to existing identity providers, there is no need to migrate users or rebuild authentication. Policy in AgentCore intercepts an agent's tool calls at AgentCore Gateway and decides whether to allow or deny them by checking them against rules that define who can call which tools with what inputs. Because the rules sit outside the agent's code, it is harder for the agent to exceed what is permitted even if it is manipulated with clever wording (features as of October 2026).
Auditing and governance of AI usage
API calls to Bedrock and SageMaker are recorded in CloudTrail, so you can later audit who invoked which model and when. Note, however, that CloudTrail captures only the metadata of API calls; the content of prompts and responses is not included. If you want to audit the content as well, enable Bedrock model invocation logging — which is disabled by default — and output the logs to CloudWatch Logs or S3. In addition, using AWS Audit Manager, you can continuously assess your compliance status against internal policies or industry standards (HIPAA, PCI DSS, etc.).