5.1.1. Securing AI Systems with IAM, Encryption, and AWS PrivateLink

First Principle: The core pillars of AI security on AWS are controlling who can access resources (IAM), protecting data wherever it is (Encryption), and isolating network traffic from the public internet (PrivateLink).

• Identity and Access Management (IAM):
  • Concept: The foundational security service in AWS. It allows you to define users, groups, and roles and grant them specific, least-privilege permissions to your AI/ML resources.
  • Application: Use an IAM Role for your SageMaker notebook to ensure it can only access the specific S3 buckets it needs for data and models, and nothing else.
• Encryption:
  • Concept: The process of encoding data so that it can only be read by authorized parties.
  • Application:
    • Encryption at Rest: Protects data when it's stored. Use AWS KMS to encrypt your data in Amazon S3 (for datasets and models) and the EBS volumes attached to your SageMaker instances.
    • Encryption in Transit: Protects data as it moves over a network. All API calls to AWS services like Bedrock and SageMaker are encrypted in transit using TLS.
• AWS PrivateLink:
  • Concept: A networking service that allows you to create a private, secure connection between your VPC and AWS services (like SageMaker or Bedrock) without exposing your traffic to the public internet.
  • Application: For high-security applications, you can ensure that all calls to your model endpoints happen entirely within your private AWS network, significantly reducing the attack surface.

Securing AI Agents: AgentCore Identity and Policy in AgentCore

Agents act on real systems, so they need their own security controls on top of IAM.

• Amazon Bedrock AgentCore Identity: Identity and credential management built for agents. Each agent gets its own workload identity; OAuth 2.0 tokens, client credentials, and API keys are kept in an encrypted token vault rather than in agent code; and agents can access third-party services on behalf of users with the user's consent (OAuth 2.0 authorization code flow) or as themselves (client credentials flow). It works with existing identity providers such as Amazon Cognito, Okta, and Microsoft Entra ID.
• Policy in AgentCore: Deterministic rules about what an agent may do. Policy intercepts every tool call that passes through AgentCore Gateway and checks it against rules, including the caller's identity and the call's input parameters, before the tool runs. Rules are written in Cedar, AWS's open-source policy language, or in plain English that is translated into Cedar. Decisions are logged for audit.

💡 Tip: A rule written in the system prompt is a request the model usually follows; a rule in Policy in AgentCore is enforced at AgentCore Gateway, outside the agent's code, so a manipulated prompt cannot talk the agent past it.

Security and privacy controls specific to generative AI

IAM, encryption and PrivateLink protect access to a model and its data. Generative AI also needs controls on what goes into and comes out of the model:

• Amazon Bedrock Guardrails (output filtering and validation): Screens prompts and responses in real time.
  • Data leakage prevention: Sensitive information filters block or mask PII (such as email addresses and phone numbers) so it does not appear in a response.
  • Toxicity: Content filters block hate, insults, violence and similar content. To measure how toxic a model is before you deploy it, use an automatic evaluation job with the toxicity metric (3.4.1).
  • Prompt injection: The content filter's prompt attack category helps detect attempts to override the model's instructions.
• Audit trail and logging for AI interactions: Two complementary logs.
  • AWS CloudTrail records who called which Bedrock API, when and from which IP address. Its model invocation entries carry request parameters such as the model ID, not the conversation text.
  • Amazon Bedrock model invocation logging records what was said: the full request and response data plus metadata, delivered to Amazon S3, Amazon CloudWatch Logs or both. It is disabled by default, so turn it on when your policies require prompt and response records. Protect these logs like any sensitive data store, because they contain whatever users typed.

Scenario: An auditor asks a bank for the exact wording of every answer its AI assistant gave customers last quarter, and for proof of which application role called the model. The bank needs invocation logging for the first request and CloudTrail for the second.

💡 Tip: "Who did it" → CloudTrail. "What was said" → invocation logging. "Stop it being said" → Guardrails.

Scenario: A healthcare company is building an AI model using sensitive patient data. They need to ensure the highest level of security and data privacy.

Reflection Question: How would you use a combination of IAM, KMS-based encryption, and AWS PrivateLink to create a secure, isolated, and compliant environment for this AI workload?

💡 Tip: Security is not a single feature; it's a layered strategy. IAM is the gatekeeper, Encryption is the safe, and PrivateLink is the private, armored tunnel.