An AI workload on AWS is protected with the same building blocks as any other workload: AWS Identity and Access Management (IAM) decides who can do what, AWS Key Management Service (AWS KMS) controls encryption keys, AWS PrivateLink keeps traffic off the internet, and Amazon Macie finds sensitive data before it reaches a model. The exam gives you a security need and expects you to pick the control that meets it, so learn what each one does and, just as important, what it doesn't do.
Least Privilege With IAM
IAM policies are the main way to control access to Amazon Bedrock and Amazon SageMaker AI. By default, a user or role can't create or change Bedrock resources at all; an administrator has to grant permissions. AWS recommends starting from AWS managed policies, such as AmazonBedrockFullAccess, and then narrowing them with your own customer managed policies. This is least privilege: grant only the actions a person or workload needs, on only the resources it needs. In Bedrock, a policy can name individual models by their resource identifier (ARN), so a team can be allowed to invoke one approved model and nothing else. A deny statement can also block inference on a model across a whole organization.
Roles That Services Assume
Some Bedrock and SageMaker AI jobs run on your behalf and need their own permissions. A model customization job, for example, has to read your training and validation files in Amazon S3 and write its results back. You give it a service role: an IAM role that trusts the Bedrock service to assume it, with permissions limited to the right buckets. SageMaker AI works the same way through its execution role. Using roles means no long-term access keys are pasted into job settings or code, and the role's permissions can be kept narrow, for example to one bucket or one folder.
Encryption With AWS KMS
Bedrock encrypts data in transit with TLS, and encrypts custom models at rest with AWS owned keys by default. That default needs no setup, but you can't see, manage or audit those keys. If a company must control the key itself, it chooses a customer managed key in AWS KMS. You can encrypt model customization jobs and their custom models, knowledge base ingestion jobs, agents and model evaluation jobs this way. With your own key you can change the key policy, revoke the service's access, and track every use of the key in AWS CloudTrail. If you remove Bedrock's access to the key, Bedrock can no longer use a model encrypted with it.
Encryption doesn't stop a model from repeating what it learned. AWS warns that a fine-tuned model can sometimes reproduce parts of its training data, so confidential records should be removed from the training set before fine-tuning, not just encrypted.
Private Network Paths
An interface VPC endpoint, powered by AWS PrivateLink, lets applications in a virtual private cloud (VPC) reach Bedrock without an internet gateway, NAT device or public IP address. The endpoint can also carry an endpoint policy, a resource-based policy that limits which principals, actions and resources can be used through it. The default endpoint policy allows full access, so a company that wants only model invocation to pass through the endpoint must attach a custom one.
Finding Sensitive Data With Macie
Training data and knowledge base documents often sit in Amazon S3. Amazon Macie scans S3 objects using machine learning and pattern matching, and reports personal information, financial data and credentials it finds. It can run automated discovery across your buckets or targeted discovery jobs, and you can add custom data identifiers for your own patterns. Macie also flags bucket problems, such as a bucket that becomes publicly accessible. It works on data stored in S3, not on prompts sent to a model.
On the Exam
Match the need to the control. "Only this team, only this model" points to an IAM policy scoped to a model ARN. "The job needs to read our S3 data" points to a service role. "We must control, rotate or revoke the key" points to a customer managed KMS key. "No public internet" points to PrivateLink, and "only some actions through the endpoint" points to an endpoint policy. "Find personal data in S3 before training" points to Macie. A common trap is picking Amazon Bedrock Guardrails for S3 data: guardrails check prompts and responses, not stored files.