Cheat Sheet: Security and Responsible AI

Last-pass revision for securing and governing generative AI on AWS. Skim the tables, drill the traps.

Controls at a glance

Decision rules

• If a policy grants bedrock:InvokeModel on *, then tighten it to the specific model ARNs in use.
• If a model returns access-denied but the IAM policy looks correct, then check model access is enabled for that account and region.
• If Bedrock traffic must not traverse the internet, then use a VPC interface endpoint with an endpoint policy.
• If you need to limit which models are reachable from a subnet, then set the restriction in the endpoint policy, not only in IAM.
• If custom or fine-tuned models hold sensitive data, then encrypt them with a customer-managed KMS key so you control revocation.
• If a knowledge base indexes confidential documents, then apply KMS to both the source data and the vector store.
• If prompt and completion content is regulated, then enable invocation logging and encrypt the logs with your key.
• If you need to block a topic or redact PII in outputs, then attach a Bedrock Guardrail and reference a published version.
• If you want to run safety checks without invoking a model, then call the ApplyGuardrail API on the text directly.
• If retrieved documents or tool responses reach the model, then treat that content as untrusted input.
• If access to a record must be enforced, then enforce it in the retrieval query and the tool, not by instructing the model in the prompt.
• If you must audit who invoked which model when, then combine CloudTrail with model invocation logging.
• If you need bias or explainability evidence for a model, then run a Bedrock evaluation job or the open-source fmeval library; SageMaker Clarify is closed to new customers, though existing deployments keep working.
• If you must communicate a model’s intended use and limits, then publish a model card and read the relevant AWS AI Service Card.
• If you need to tell whether an image came from one of Amazon’s own generators, then check for the built-in watermark with the detection capability.
• If the image came from a third-party generator, then there is no watermark to find, and provenance has to come from a record your pipeline wrote at generation time.
• If guardrail behaviour must be reproducible across releases, then apply a published guardrail version rather than the working draft.

Traps

• A system prompt is not a security boundary. Instructions in the prompt can be overridden by injected content; enforce access in identity, retrieval, and tools.
• Model access and IAM are two separate gates. Enabling a model in the console does not grant InvokeModel, and an IAM allow does nothing until the model is enabled.
• Access control belongs in retrieval, not the prompt. Filter documents by the caller’s entitlements at query time; do not rely on telling the model to ignore what it should not see.
• Retrieved and tool-returned content is untrusted. A poisoned document can carry instructions; apply guardrails and output filtering, and never let retrieved text expand a tool’s authority.
• Guardrails apply per published version. If you point at the draft or forget to attach the guardrail on the invocation, nothing is filtered.
• Bedrock not training on your data is about the base models. It does not mean your prompts vanish; logging, retrieval stores, and any fine-tuning data still need their own controls.
• KMS on the model is not KMS on everything. Knowledge base data, the vector index, and invocation logs each need encryption configured separately.
• Contextual grounding reduces hallucination against provided sources; it is not a factuality guarantee for claims outside those sources.
• PII redaction in Guardrails covers the configured entity types. Anything you did not list can still pass through.
• Do not put secrets in prompts. They land in logs and can be echoed back; pass credentials through the execution role, not the text.
• A VPC endpoint keeps traffic private but does not scope permissions. You still need IAM and an endpoint policy to limit actions.
• Watermark detection is model-specific. It confirms provenance for the Amazon generators that embed one, not that any arbitrary image is or is not AI-generated, and a negative result on a third-party generator’s output means nothing.
• WAF and API Gateway see volume, never prompt semantics. Rate limits, IP rules and bot control stop floods and scraping; one well-formed request carrying an injection looks exactly like a legitimate one, so the semantic checks stay in guardrails and output filtering.
• Deleting an S3 source object does not remove its embedding. The chunk stays in the vector index until the knowledge base re-syncs, so a deletion request is only served once the sync has run or the vectors have been deleted directly.
• SageMaker Model Monitor bias drift monitoring needs a deployed classic-ML endpoint and a captured baseline, and it closed to new customers in July 2026, so it is not the answer for a Bedrock feature. There, drift means scheduled evaluation jobs publishing CloudWatch metrics you compare across runs.
• The named SageMaker responsible-AI services are maintenance-only. Clarify, Model Monitor, A2I, and Ground Truth closed to new customers in late July 2026; existing deployments keep running. Measurement is a Bedrock evaluation job or the open-source fmeval library, monitoring is CloudWatch plus invocation logging plus scheduled evaluation jobs, and human review loops are assembled from Step Functions or SQS with your own reviewer UI.

Say it in one line

1. Scope bedrock:InvokeModel to specific model ARNs and use roles, never long-lived keys.
2. Model access enablement in the console is a distinct gate from IAM permissions.
3. SCPs and permission boundaries cap what principals and roles can do and grant across an organisation.
4. A VPC interface endpoint with PrivateLink keeps Bedrock traffic off the internet; the endpoint policy scopes it.
5. Customer-managed KMS keys let you encrypt custom models, knowledge base data, vector indexes, and invocation logs, and revoke by disabling the key.
6. Bedrock does not train its base models on your prompts or completions, and your data stays in the region you call.
7. Bedrock Guardrails cover denied topicsDenied topicsSubjects you describe in plain language that a Bedrock Guardrail refuses to discuss, whichever way a user phrases the request., content and word filters, PII detection and redaction, contextual grounding, and a prompt-attack filter.
8. ApplyGuardrail evaluates text against a guardrail without a model call; always reference a published version.
9. Treat retrieved and tool content as untrusted, and enforce access in retrieval and tools rather than in the prompt.
10. A system prompt is not a security boundary, and secrets never belong in prompts.
11. CloudTrail plus model invocation logging gives you the audit trail; Audit Manager collects evidence and tracks data lineage.
12. Bias and explainability reports come from Bedrock evaluation jobs or the open-source fmeval library; model cards and AWS AI Service Cards document intended use and limits.
13. Amazon’s own image generators watermark their output and the detection capability confirms it, but Nova Canvas is legacy (end of life 30 September 2026) and the Titan Image Generator is delisted, so new work records its own provenance at generation time.
14. Version prompts, models, and guardrails so what shipped is reproducible and auditable.