Cheat Sheet: Security and Responsible AI

Last-pass revision for securing and governing generative AI on AWS. Skim the tables, drill the traps.

Controls at a glance

Decision rules

• If a policy grants bedrock:InvokeModel on *, then tighten it to the specific model ARNs in use.
• If a first call to a third-party model returns access-denied but the Bedrock policy looks correct, then check the caller holds the AWS Marketplace subscribe permissions, and that the Anthropic use-case form has been submitted.
• If Bedrock traffic must not traverse the internet, then use a VPC interface endpoint with an endpoint policy.
• If you need to limit which models are reachable from a subnet, then set the restriction in the endpoint policy, not only in IAM.
• If custom or fine-tuned models hold sensitive data, then encrypt them with a customer-managed KMS key so you control revocation.
• If a knowledge base indexes confidential documents, then apply KMS to both the source data and the vector store.
• If prompt and completion content is regulated, then enable invocation logging and encrypt the logs with your key.
• If you need to block a topic or redact PII in outputs, then attach a Bedrock Guardrail and reference a published version.
• If you want to run safety checks without invoking a model, then call the ApplyGuardrail API on the text directly.
• If retrieved documents or tool responses reach the model, then treat that content as untrusted input.
• If access to a record must be enforced, then enforce it in the retrieval query and the tool, not by instructing the model in the prompt.
• If you must audit who invoked which model when, then combine CloudTrail with model invocation logging.
• If you need quality or safety evidence for a generative model, then run a Bedrock evaluation job, which covers automatic metrics, a judge model, human review and RAG evaluation.
• If you need bias or explainability evidence, then use the open-source fmeval library for prompt stereotyping and toxicity, and SHAP for feature attribution; SageMaker Clarify is closed to new customers, though existing deployments keep working.
• If you must communicate a model’s intended use and limits, then publish a model card and read the relevant AWS AI Service Card.
• If you need to tell whether an image came from Titan Image Generator G1 or Nova Canvas, then use watermark detection, which is in public preview in us-east-1 and us-west-2 only.
• If the image came from a third-party generator, then that detection returns nothing, so fall back to the C2PA content credentials in the file, or to a record your pipeline wrote at generation time.
• If guardrail behaviour must be reproducible across releases, then apply a published guardrail version rather than the working draft.

Traps

• A system prompt is not a security boundary. Instructions in the prompt can be overridden by injected content; enforce access in identity, retrieval, and tools.
• Model enablement is no longer a manual console step. Foundation models are enabled by default. Bedrock starts the AWS Marketplace subscription on the first invoke, so the gate is aws-marketplace:Subscribe on that first call. The console Model access page is now a GovCloud-only workflow. To keep a model out, deny bedrock:InvokeModel on its ARN in an SCP or IAM policy. Denying the subscribe action alone does not stop the first call.
• Access control belongs in retrieval, not the prompt. Filter documents by the caller’s entitlements at query time; do not rely on telling the model to ignore what it should not see.
• Retrieved and tool-returned content is untrusted. A poisoned document can carry instructions; apply guardrails and output filtering, and never let retrieved text expand a tool’s authority.
• DRAFT is a valid guardrail version and it does filter. The risk is that it changes under you, so behaviour is not reproducible; pin a numbered version for that. Forgetting to attach the guardrail to the invocation is the case where nothing is filtered.
• Bedrock not training on your data is about the base models. It does not mean your prompts vanish; logging, retrieval stores, and any fine-tuning data still need their own controls.
• KMS on the model is not KMS on everything. Knowledge base data, the vector index, and invocation logs each need encryption configured separately.
• Contextual grounding reduces hallucination against provided sources; it is not a factuality guarantee for claims outside those sources.
• Sensitive-information filtering covers the entity types and regexes you configured. Anything you did not list can still pass through.
• Do not put secrets in prompts. They land in logs and can be echoed back; pass credentials through the execution role, not the text.
• A VPC endpoint keeps traffic private but does not scope permissions. You still need IAM and an endpoint policy to limit actions.
• Watermark detection is model-specific and still in preview. It covers Titan Image Generator G1 and Nova Canvas in two Regions, and reports whether those models made the image, not whether an arbitrary image is AI-generated. A negative result on a third-party generator’s output means nothing. Editing the image lowers accuracy.
• WAF and API Gateway match on volume and request shape, not prompt semantics. Rate limits, IP rules and bot control stop floods and scraping; one well-formed request carrying an injection looks exactly like a legitimate one, so the semantic checks stay in guardrails and output filtering.
• Deleting an S3 source object does not remove its embedding. The chunk stays in the vector index until the knowledge base re-syncs, so a deletion request is only served once the sync has run or the vectors have been deleted directly.
• SageMaker Model Monitor bias drift monitoring needs a deployed classic-ML endpoint and a captured baseline, so it is not the answer for a Bedrock workload. There, drift means scheduled evaluation jobs publishing CloudWatch metrics you compare across runs.
• The named SageMaker responsible-AI services are maintenance-only. Clarify, Model Monitor, Augmented AI and Ground Truth closed to new customers on 30 July 2026. So did Mechanical Turk, Studio Lab, Debugger, Role Manager, Geospatial and Profiler. Existing deployments keep running and keep getting security fixes, but no new features. Measurement is a Bedrock evaluation job, fmeval or SHAP. Monitoring is CloudWatch plus invocation logging plus scheduled evaluation jobs. Human review loops are assembled from Step Functions or SQS with your own reviewer UI.

Say it in one line

1. Scope bedrock:InvokeModel to specific model ARNs and use roles, never long-lived keys.
2. Foundation models are enabled by default. The first-invoke gate is AWS Marketplace subscribe permissions, and a deny on bedrock:InvokeModel is what blocks a model.
3. SCPs and permission boundaries cap what principals and roles can do and grant across an organisation.
4. A VPC interface endpoint with PrivateLink keeps Bedrock traffic off the internet; the endpoint policy scopes it.
5. Customer-managed KMS keys let you encrypt custom models, knowledge base data, vector indexes, and the invocation log destination, and revoke by disabling the key.
6. Bedrock does not train its base models on your prompts or completions, and your data stays in the region you call.
7. Bedrock Guardrails cover content filters (with prompt attacks as a category inside them), denied topicsDenied topicsSubjects you describe in plain language that a Bedrock Guardrail refuses to discuss, whichever way a user phrases the request., word filters, sensitive-information filters, contextual grounding, and Automated Reasoning checks.
8. ApplyGuardrail evaluates text against a guardrail without a model call; DRAFT works but a numbered version is what makes behaviour reproducible.
9. Treat retrieved and tool content as untrusted, and enforce access in retrieval and tools rather than in the prompt.
10. A system prompt is not a security boundary, and secrets never belong in prompts.
11. CloudTrail plus model invocation logging gives you the audit trail; Audit Manager collects the evidence, and lineage comes from SageMaker Catalog over your Glue sources.
12. Bedrock evaluation jobs cover generative quality and safety; bias and explainability come from fmeval and SHAP, and model cards plus AWS AI Service Cards document intended use and limits.
13. Titan Image Generator G1 and Nova Canvas add an invisible watermark and C2PA content credentials. Detection is preview-only in two Regions, and Nova Canvas reaches end of life on 30 September 2026, so record provenance at generation time.
14. Version prompts, models, and guardrails so what shipped is reproducible and auditable.