Securing AI Systems

A foundation model reads instructions and data through the same channel, which means a sentence buried in a support ticket can carry as much weight as your system prompt. That single property creates a threat surface no ordinary application has, sitting on top of every threat an ordinary application already faces. This topic covers what can go wrong across an AI system and the AWS controls that answer each failure.

It moves from the outside in: the threats first, then the services that contain them, then the data pipeline that feeds the model, then the record that proves what went in, and finally the checks that decide whether the output can be trusted.

What This Topic Covers

• why an LLM cannot separate instructions from data, and what that costs
• prompt injection, direct and indirect, plus poisoning, excessive agency, improper output handling, and model extraction
• where each threat enters, split between build time and run time
• the AWS shared responsibility model applied to Amazon Bedrock and SageMaker AI
• IAM for model access, service roles, and agent tool permissions
• KMS encryption at rest, TLS in transit, and which Bedrock resources take a customer managed key
• AWS PrivateLink and VPC endpoints for keeping traffic off the public internet
• Amazon Macie, GuardDuty, and Inspector, and the question each one answers
• CloudTrail against Bedrock model invocation logging as two different audit trails
• Amazon Bedrock AgentCore Identity for agent authentication and credentials
• AWS Glue Data Quality rulesets, DQDL, and the data quality score
• privacy-enhancing technologies from redaction through synthetic data
• layered data access control with S3, IAM, and Lake Formation column and row permissions
• data integrity through checksums, versioning, and immutable snapshots
• provenance, lineage, and cataloging, and how they differ
• SageMaker ML Lineage Tracking, Model Cards, and the Model Registry
• knowledge base citations, contextual grounding thresholds, output validation, and confidence routing

Why It Matters

Domain 5 questions are usually a requirement plus four AWS services that sound interchangeable. Macie finds sensitive data in S3, GuardDuty flags malicious activity, Inspector scans for vulnerabilities, CloudTrail records who called what, and model invocation logging holds the prompt itself. Sorting them by the question each one answers is most of the work in this topic.

Outside the exam, this is the material that decides whether a working prototype ever reaches production. Security teams ask where the traffic goes, legal teams ask what the model was trained on, and auditors ask you to prove both months later. Every control here exists because someone had to answer one of those questions in writing.