Securing AI Solutions — AWS AIF-C01

AWS Identity and Access Management (IAM) controls authentication and authorization across all AWS services, including AI services like Amazon Bedrock, SageMaker, and Rekognition. IAM users, groups, and roles get permissions through JSON policies specifying which actions are allowed or denied on which resources. The key exam nuance is identity-based policies (attached to a principal such as a role) versus resource-based policies (attached to the resource itself). SageMaker training jobs and Bedrock agents assume an IAM execution role at runtime, so misconfigured role trust relationships are a common source of access-denied errors. Apply least privilege.

Encryption protects AI workloads at two layers: data at rest (in Amazon S3, EBS, or RDS) and data in transit (over TLS between services). AWS Key Management Service (KMS) creates and controls the keys used to encrypt training datasets, model artifacts, and inference outputs, and Amazon SageMaker integrates with KMS for training jobs, endpoints, and notebooks. The key exam distinction is AWS managed keys, which AWS creates and rotates automatically, versus customer managed keys, which give you control over key policies, rotation, and access revocation — often a compliance requirement in regulated industries.

Amazon Macie uses machine learning to automatically discover, classify, and protect sensitive data stored in Amazon S3, identifying personally identifiable information (PII), financial data, and credentials. It surfaces findings through AWS Security Hub or Amazon EventBridge for remediation, making it a natural gate before raw S3 data feeds AI/ML pipelines so training datasets reach Amazon SageMaker or Bedrock scrubbed of sensitive content. The exam distinction is scope: Macie is S3-specific, not general data-loss prevention. Don’t confuse it with AWS Glue (data cataloging) or Amazon Comprehend (runtime NLP entity detection in text); Macie handles pre-training data hygiene and ongoing S3 compliance monitoring.

AWS PrivateLink creates interface VPC endpoints that route traffic to supported services over the AWS backbone instead of the public internet. Calling Amazon Bedrock or Amazon SageMaker from a VPC through a PrivateLink endpoint keeps sensitive request payloads — such as PII sent to a foundation model — off the public network, supporting compliance needs like HIPAA and SOC 2. The exam distinction: PrivateLink governs the network path, not who may call the service. IAM and resource-based policies still control authorization, so a private path alone does not stop an unauthorized principal from invoking Bedrock.

Data lineage is the end-to-end record of where data originates, how it moves between systems, and what transformations are applied before reaching a model or output. Amazon SageMaker ML Lineage Tracking automatically captures relationships among training datasets, processing jobs, models, and endpoints, storing them as a directed acyclic graph of artifacts and associations that teams query for compliance audits or debugging. Provenance asks “where did this data come from?”; lineage adds every downstream transformation. On the AIF-C01 exam, lineage supports responsible AI by enabling reproducible training conditions and auditable, trustworthy pipelines.

The OWASP Top 10 for Large Language Models is a community-maintained list of the ten most critical security risks in LLM-powered applications. It covers prompt injection, insecure output handling, training data poisoning, model denial-of-service, sensitive information disclosure, and insecure plugin design, among others. On AIF-C01, it is the industry baseline for responsible AI security and is distinct from the classic OWASP Web Application Top 10. When using Amazon Bedrock, controls such as Guardrails, IAM policies, and VPC endpoints help mitigate several of these LLM-specific risks.

Amazon Inspector is an automated security assessment service that continuously scans EC2 instances, Amazon ECR container images, and AWS Lambda functions for software vulnerabilities and unintended network exposure. It generates risk-scored findings and integrates with AWS Security Hub for a consolidated view of security posture across an account. For AIF-C01, the key distinction is scope: Inspector targets software vulnerabilities and network reachability in compute workloads, whereas AWS Config evaluates resource configuration compliance against rules, and Amazon Macie discovers sensitive data in S3. Inspector is the answer whenever a question asks about CVE detection or container image scanning before deployment.