Security, IAM and Compliance for AI Workloads

Security is the second-heaviest domain on the AIF-C01 exam: Domain 2 "Security, Compliance, and Governance" carries 24 % of the score, out of a 65-question exam (50 scored + 15 unscored) with no penalty for guessing. What makes it hard is not the vocabulary; it is that AWS phrases the same requirement in four different places, and the exam rewards you for knowing which place is authoritative. "Is Bedrock HIPAA compliant?" has a different correct answer depending on whether you read a marketing page, the service's own documentation, or the AWS Services in Scope table.

By the end of this lesson you will be able to:

• name every IAM role type an AI workload can use and say who assumes it;
• write a least-privilege SageMaker execution role and explain why AmazonSageMakerFullAccess still needs a second S3 statement;
• apply the cross-account rule correctly: an Allow is required in both the identity policy and the resource policy;
• choose between SSE-S3 and SSE-KMS (and know when only one is possible);
• design a private ML VPC: gateway endpoint vs. interface endpoint vs. NAT, and why SageMaker endpoints need two subnets in two Availability Zones;
• separate CloudTrail management events from data events for bedrock-runtime, bedrock-mantle and SageMaker;
• prove a compliance claim the AWS way: Services in Scope → AWS Artifact → BAA for HIPAA-eligible services;
• defend the comparative verdict: IAM vs. shared keys, VPC endpoint vs. NAT, SSE-KMS vs. SSE-S3.

---

1. Shared responsibility, and what "AI security" adds

1.1 The sentence AWS actually publishes

Amazon Bedrock's own security documentation does not hand you a checklist. It says responsibility "is determined by the sensitivity of your data, your company's compliance objectives, and applicable laws and regulations." That sentence is the whole philosophy: AWS secures the infrastructure and the service, you secure what you put into it and who is allowed to touch it, and the sensitivity of an AI workload (prompts, embeddings, fine-tuning data, model outputs) is the variable the exam keeps testing.

1.2 The split, layer by layer

• 📚 Did you know? AWS publishes 143 compliance offerings across its services. The count is a distraction on purpose: the exam never asks for the total, it asks whether this specific service is in scope for this specific program, and the only authoritative answer is the AWS Services in Scope by Compliance Program table, not a service marketing page.

1.3 The first trap: "HIPAA certified" does not exist

There is no HIPAA certification for AWS, for Amazon Bedrock, for SageMaker, or for any cloud service provider. The correct phrasing, and the phrasing the exam uses, is:

1. sign a Business Associate Agreement (BAA) with AWS, and
2. use only HIPAA-eligible services to store or process protected health information (PHI).

AWS further maps the HIPAA Security Rule to FedRAMP and NIST SP 800-53 (guidance for which is SP 800-66), which is why those two names appear together in every correct HIPAA option.

---

2. Identity: the roles behind every AI job

2.1 The role types, in one table

SageMaker alone documents four kinds of role, and Bedrock adds two more. Learn who assumes each one; that is what the question always tests.

Two details worth memorising:

• ExecutionRoleSessionNameMode = USER_IDENTITY puts the end user (not a shared job name) into CloudTrail: the setting that turns "the job did it" into "Priya's credentials did it".
• The Role Manager personas are Data scientist, MLOps and SageMaker AI compute: three roles, not a free-text list.

2.2 Example 1: a least-privilege SageMaker execution role

Four statements, one account (111122223333), one bucket (acme-ml-artifacts), one Region (us-east-1). Compare this with the managed policy in the next subsection: the difference is the exam answer.

2.3 The AmazonSageMakerFullAccess S3 caveat

AWS documents a specific restriction inside AmazonSageMakerFullAccess: certain S3 actions are granted only on buckets and objects whose names contain SageMaker, Sagemaker, sagemaker or aws-glue, plus a short list of actions that apply to any S3 resource. Consequences:

• a bucket named acme-ml-artifacts is not covered; you must attach a second policy, exactly as in Example 1;
• an option claiming "FullAccess grants s3:* on every bucket in the account" is false;
• an option claiming "FullAccess grants no S3 permissions" is equally false.

The practical lesson is broader than S3: a managed policy is a starting point, not a design. The exam repeatedly rewards the candidate who says "customer-managed policy scoped to the resource ARN".

2.4 Example 2: allow one model family, deny another

Note the coupling: denying InvokeModel plus InvokeModelWithResponseStream also denies Converse/ConverseStream, because the latter are built on the former. To enforce this org-wide you leave the account boundary and write an SCP over bedrock:Invoke*, bedrock:Converse* and sagemaker:InvokeEndpoint*.

2.5 Example 3: a Bedrock customization service role that resists the confused deputy

Three habits are packed into this policy:

1. aws:SourceAccount in the trust policy: the confused-deputy guard AWS recommends for every Bedrock service role (customization, import, batch, agents, knowledge bases, Flows, evaluations);
2. aws:SourceArn on top of it for job-level scope;
3. for Bedrock specifically, iam:PassedToService = bedrock.amazonaws.com where the caller passes a role, and a matching key-policy statement so KMS actually allows the job.

2.6 How a request is evaluated: everything caps, nothing grants

The rule the exam keeps rephrasing: a permissions boundary, a service control policy (SCP) and a resource control policy (RCP) all cap maximum possible permissions: none of them grants anything. A boundary with no identity policy attached gives a user zero effective permissions, not the boundary's permissions.

2.7 Example 4: a permission boundary capping an ML developer

Effective permission = identity policy ∩ boundary. The developer keeps whatever their identity policy allows, but can never exceed these four services, and can never delete a model or an endpoint even if their identity policy says sagemaker:*.

Order the steps of building that role:

---

3. Bedrock identity: managed policies, resource policies and cross-account

3.1 Seven managed policies, and their dates

Amazon Bedrock ships 7 AWS managed policies, and the exam likes the timeline:

3.2 Identity-based and resource-based, and why guardrails need both

Bedrock accepts identity-based policies (who you are) and resource-based policies (what object is being touched). Guardrails and inference profiles take resource policies, and AWS states that a resource policy is required for organization-level enforcement: to stop an entire org from invoking a model without a guardrail attached, you attach a resource policy evaluated with bedrock:GuardrailIdentifier and back it with an SCP. An identity policy alone cannot express "this guardrail must be present".

3.3 Cross-account: the Allow must exist on both sides

Concretely, for a shared S3 bucket and a shared guardrail:

1. Account B (444455556666) creates role/CrossAccountBedrock trusting {"AWS":"arn:aws:iam::111122223333:root"} and puts a resource policy on the bucket/guardrail allowing account A;
2. Account A attaches an identity policy with {"Action":"sts:AssumeRole","Resource":"arn:aws:iam::444455556666:role/CrossAccountBedrock"};
3. both Allows are required: for KMS you must pass your own CMK, because an AWS-managed S3 key policy cannot be shared that way.

Example 5: the missing half: the resource policy on account B's bucket.

Account 111122223333 (identity) plus this statement in 444455556666 (resource) = the two Allows the rule demands; the second statement additionally enforces TLS in transit on the bucket.

3.4 Permission boundaries, SCPs and RCPs compared

• 📚 Did you know? The Role Manager feature and the service-linked role path are both tied to Studio Classic. In Studio (the current experience) you assign domain, space and user roles per persona; which is why an option describing "let SageMaker create the role automatically" is a Studio Classic answer, and an option describing three personas is a Role Manager answer.

---

4. Encryption: at rest and in transit

4.1 In transit: TLS 1.2 is the number

AWS states TLS 1.2 as the minimum in transit for these services. In CloudTrail you can verify the negotiated version through tlsDetails.tlsVersion. Any option offering "TLS 1.0 or higher", "SSL", or "TLS 1.3 only" is wrong in opposite directions.

4.2 At rest: defaults, options and the two exceptions

Two exceptions carry disproportionate exam weight:

1. A keyless SageMaker volume gets a transient key that is discarded after encryption, so "SageMaker volumes are unencrypted" is false, and "you must supply a KMS key" is also false.
2. Cross-account S3 access needs your CMK. If account A reads account B's bucket, the default AWS-managed key policy of account B will not cooperate; account A must supply and control a customer managed key.

4.3 Choosing between SSE-KMS and SSE-S3 in one sentence

SSE-S3 is the default, has no key-management overhead and no KMS request charges; SSE-KMS gives you a customer managed key with an audit trail in CloudTrail, key policies and grants, and per-key rotation, and it is the only way to satisfy a cross-account requirement or a policy that demands CMK enforcement. AWS Config rules such as sagemaker-endpoint-config-kms-key-required and sagemaker-featuregroup-encryption-at-rest exist precisely to detect when you kept the default.

---

5. Network isolation: VPCs, gateway endpoints and PrivateLink

5.1 The VpcConfig contract

SageMaker's VpcConfig accepts 1 to 16 subnets and 1 to 5 security groups, and SageMaker creates elastic network interfaces (ENIs) in each subnet. The hard rule candidates miss:

A SageMaker endpoint needs at least 2 subnets in at least 2 Availability Zones: even if you launch a single instance.

Training jobs need at least 2 private IPs per instance (at least 5 with EFA), and the security group must allow inbound TCP 443 on the ENI path.

5.2 The seven Bedrock PrivateLink services

With PrivateLink you get: no internet gateway, no NAT, no VPN or Direct Connect requirement, and no public IPs. Private DNS enabled means your code does not change; private DNS disabled means you rewrite calls to {vpce-id}.bedrock-runtime.{region}.vpce.amazonaws.com. The endpoint's security group must allow inbound 443, and you can attach a custom endpoint policy to narrow which actions or model ARNs are reachable.

5.3 Four VPC patterns and what they cost

5.4 Example 6: a working private Bedrock + SageMaker layout (Pattern B)

1. 10.20.0.0/16 with private 10.20.1.0/24 (AZ-a) and 10.20.2.0/24 (AZ-b); no IGW route, no NAT;
2. S3 gateway endpoint attached to both route tables, with an endpoint policy limited to arn:aws:s3:::acme-*;
3. interface endpoints in both subnets for bedrock-runtime, bedrock, sagemaker, sagemaker.api, sagemaker.runtime, ecr.api, ecr.dkr, logs and kms; endpoint security group inbound 443 from 10.20.0.0/16;
4. VpcConfig = {Subnets:[a,b], SecurityGroupIds:[sg-ml]}; sg-ml egress limited to 443 toward the endpoint security group; notebook DirectInternetAccess = Disabled;
5. flow: Studio user → SageMaker ENI → endpoint ENI → Bedrock runtime over the AWS network with TLS 1.2. CloudTrail records the call as a management event in the source Region, and GuardDuty AI Protection reads it through its service-linked channel. Fallback (Pattern C) adds an IGW, public subnets and a NAT gateway only when a dependency has no interface endpoint.

5.5 The secure VPC / ML architecture

---

6. Audit: CloudTrail, invocation logging, GuardDuty and Config

6.1 Management vs. data events: the free/paid line

Management events are free and on by default; data events are opt-in and charged. CloudTrail event history retains 90 days of management events in the console.

6.2 Model invocation logging is a separate switch, and it is off

Bedrock's model invocation logging is off by default. When you enable it:

• destinations are CloudWatch Logs and/or S3, and they must be in the same account and the same Region;
• an inline prompt/completion body of ≤100 KB is stored inline: larger bodies go to an S3 prefix under data/;
• logging is not CloudTrail: CloudTrail tells you who called what, invocation logging tells you what was said.

6.3 GuardDuty AI Protection

GuardDuty's AI Protection reads Bedrock, AgentCore and SageMaker data events plus management events, through a service-linked CloudTrail channel that GuardDuty creates for you. Notable findings:

These are findings and alerts, not blocks: GuardDuty tells you a guardrail was intervened on; only the guardrail itself blocks content.

6.4 AWS Config: rules and packs for AI

Config rules prefixed sagemaker- include:

• sagemaker-notebook-no-direct-internet-access
• sagemaker-notebook-instance-inside-vpc
• sagemaker-endpoint-config-kms-key-required
• sagemaker-featuregroup-encryption-at-rest

And there are three conformance packs aimed at AI: Best Practices for Amazon Bedrock, Best Practices for Amazon SageMaker AI and Best Practices for AI/ML Supporting Infrastructure. NIST SP 800-171 control 3.1.1 maps to sagemaker-notebook-no-direct-internet-access, and AWS states that sample templates do not guarantee passing a compliance audit.

• 📚 Did you know? A Guardrail removal and a flip of model invocation logging to disabled are both treated as security events by GuardDuty's Foundational plan. That is unusual, most "configuration drift" is only visible in Config, and it is a strong hint that the exam considers "quietly turning off your safety net" an attack, not an admin chore.

6.5 Status dashboard (October 2026)

---

7. Compliance: HIPAA, AWS Artifact and what Bedrock actually publishes

7.1 The only authoritative chain

Three rules fall out of that diagram:

1. AWS Services in Scope is the only authoritative "is it covered" table: ✓ means in scope in the current reports;
2. AWS Artifact is where the actual SOC / ISO / FedRAMP reports live: never a service page, never a console link labelled "Compliance";
3. for HIPAA you need a BAA plus HIPAA-eligible services; AWS maps the Security Rule to FedRAMP + NIST 800-53.

7.2 What Amazon Bedrock publishes

Amazon Bedrock's published compliance set is: ISO, SOC, CSA STAR Level 2, GDPR, HIPAA eligible, and FedRAMP High in AWS GovCloud (US-West): plus a FedRAMP per-model matrix (published 18 Sep 2026) covering Class C/D models and IL4/IL5.

7.3 Numbers worth carrying into the exam

• 📚 Did you know? The phrase "in scope" has a precise meaning: it says the service was included in the auditor's report for that period: not that your workload is compliant. That is why every compliance option that says "enabling GuardDuty achieves HIPAA compliance" is false: you can be in scope and still fail your own obligations under the shared responsibility model.

---

8. Data governance: retention, residency and content moderation

8.1 Retention modes for Bedrock

Retention modes are none, default, aws_review, provider_data_share and inherit, with scope flowing project → account → model default, per Region, with no propagation between Regions. The examinable facts:

• aws_review keeps data inside the AWS boundary for ≤30 days and it is never given to the model provider;
• the control plane condition keys are bedrock:DataRetentionMode / bedrock-mantle:DataRetentionMode, enforceable with SCP and IAM;
• fine-tuning data is used only to fine-tune, never to train the base Titan models, and nothing is stored after the job, but the fine-tuned model can still replay it, so filter or delete sensitive rows before you start;
• at launch there is no console UI for retention modes: API/SDK only.

8.2 Example 7: enforcing zero data retention org-wide (SCP)

Effect: only none can ever be set; a model that requires aws_review then returns ValidationException / status: unavailable. The control-plane variant swaps in bedrock:PutAccountDataRetention and bedrock:DataRetentionMode.

8.3 Cross-Region inference: Geographic vs Global

CloudTrail logs the call in the source Region. Neither mode adds a routing surcharge, and neither supports Provisioned Throughput.

8.4 Content moderation: the full toolbox

Guardrails specifics from the digest: 6 filter categories, Hate, Insults, Sexual, Violence, Misconduct and Prompt Attack, plus tier CLASSIC|STANDARD and blocked-response messaging of 1 to 500 characters. PII detection is probabilistic ML, which is exactly why you can choose mask instead of block.

8.5 Rekognition moderation limits

DetectModerationLabels accepts JPEG and PNG only, uses a 3-level taxonomy with MinConfidence defaulting to 50 %, and works with Amazon A2I for human review. The hard limit AWS states in writing: the APIs do not detect illegal content such as CSAM: no confidence threshold fixes that, and no exam option should claim otherwise.

• 📚 Did you know? AWS's own guardrail guidance says: "Disable Invocation Logs if you do not want blocked content to appear as plain text in the logs." In other words, the log you enable for auditing can become the place where the very content you blocked is stored verbatim: a genuine design trade-off, and a rare case where AWS explicitly recommends turning a logging feature off.

---

9. Comparative verdict

---

10. Exam traps and the numbers worth memorizing

10.1 The testable numbers

10.2 Flagged as not verified in this lesson

To keep a research gap from becoming a wrong answer: PCI DSS scope for Amazon Bedrock (absent from Bedrock's own pages); SageMaker's HIPAA eligibility (the HIPAA Eligible Services Reference was not retrieved); Region availability of GuardDuty AI Protection; per-rule contents of the three AI conformance packs; exact prices for NAT gateways, interface endpoints, PrivateLink and GuardDuty AI Protection (cost statements here are directional); AIF-C01 per-topic weights (only the domain weights 20/24/28/14/14 are published); and Role Manager availability for new customers. Treat every one of them as "check the source page before you assert it".

---

Real-World Case Studies

Five AWS-published customer stories, retrieved for this course on 06 Oct 2026, exercise Domain 2 controls in production. Read them as evidence, not marketing: every percentage below is a customer/AWS-claimed, unaudited figure, and only Sun Finance (n = 585 images) and Adobe (their own test set) disclose a sample basis. The exam will not ask you to recall these numbers; it asks you to recognise which control each one proves.

Case-study evidence for Domain 2

What the cases actually prove

The failure patterns are as examinable as the successes: DIY inference (Forethought abandoned its own Amazon EKS stack for SageMaker multi-model endpoints at −66 % and Serverless Inference at ≈−80 %), LLM-only OCR (Sun Finance, above) and in-house custom computer vision (Chronomics, four months versus three-to-four weeks). Each is a question about choosing the right tier, which is Domain 1, but each also has a Domain 2 tail: who owns the credentials, where the data sits, and what evidence you can produce afterwards.

• 📚 Did you know? AWS publishes exactly one project-outcome rate: 65 % of Generative AI Innovation Center projects reached production in 2025 (some in as little as 45 days), drawn from more than 1,000 implementations and organised around the Five V's framework: Value → Visualize → Validate → Verify → Venture. The other 35 % did not ship. Any option claiming "all AWS generative AI pilots succeed" contradicts AWS's own blog.

---

Regulation and AWS service changes

2025 to 2026 Updates

Everything below was verified for this course on 06 Oct 2026 and comes from first-party sources: the European Commission's regulatory-framework page, AWS's own certification and service-availability notices, and AWS product pages. Dates are staged, and collapsing them is the classic way to lose this mark.

Penalty ceilings under the EU AI Act:

Two governance frameworks sit behind those dates and are still voluntary: the NIST AI Risk Management Framework (AI 100-1, Jan 2023: Govern, Map, Measure, Manage, 19 categories / 72 subcategories) with its Generative AI Profile NIST AI 600-1 (Jul 2024, 12 risks), and ISO/IEC 42001:2023 (Dec 2023), the first certifiable AI Management System. AWS's own position is unchanged by all of this: compliance evidence comes from AWS Services in Scope and AWS Artifact, and HIPAA still means BAA + HIPAA-eligible services.

• 📚 Did you know? AWS defines a three-word service lifecycle that shows up in exam options: Maintenance (no new customers, no new features, still supported), Sunset (planned end of operations, typically 12 months) and Full Shutdown (removed from the portfolio). On 30 Jul 2026 a large block of SageMaker features, including Role Manager, moved to maintenance, which is why old study notes describing them as "the current path for a new workload" are already wrong.

---

Practice Questions

---