Security, Identity, and Data Protection for Generative AI
Core concepts
Understand IAM for Bedrock: identity-based policies, resource-based policies, service roles, and least privilege on bedrock:InvokeModel and knowledge base actions. Know AWS PrivateLink and VPC endpoints for private connectivity, AWS KMS customer managed keys for encrypting knowledge base vector stores, and how Bedrock handles data (not used to train base models). Understand prompt injection and jailbreak risks, including indirect injection through retrieved documents. Know secrets management for API keys, cross-account access patterns, and CloudTrail plus model invocation logging for audit. Understand data classification, PII detection with Amazon Comprehend or Macie, and redaction before sending data to a model.
Traps
- Assuming the model provider trains on your prompts; know the actual data-handling terms for the service used.
- Overly broad
bedrock:*policies instead of scoped resource ARNs. - Ignoring indirect prompt injection from retrieved content or tool outputs.
- Sending PII to models without redaction or a documented lawful basis.
- Forgetting that logging configurations can themselves capture sensitive prompt data.
Worked example
A RAG app retrieves customer contracts. Rule of thumb: enforce metadata filters tied to the caller's identity so retrieval cannot cross tenants, encrypt the vector store with a customer managed KMS key, redact PII before generation, and log invocation metadata to CloudTrail without storing raw prompt text.
Rule of thumb
Treat retrieved text and tool outputs as untrusted input; never let them expand the agent's permissions.