CertBrain
Courses
Home
Blog
Sign in
← Back to decks
Sign in to save your progress, vote, and build your own decks.Sign in

AWS Infrastructure Benefits for GenAI

Many companies hesitate to use generative AI (GenAI) because they worry about where their data goes, whether they can meet regulations, and what the model might say to customers. Running GenAI on AWS infrastructure answers those concerns with four benefits the exam names: security, compliance…

9 cards
Study this deck

AWS Infrastructure Benefits for GenAI

Many companies hesitate to use generative AI (GenAI) because they worry about where their data goes, whether they can meet regulations, and what the model might say to customers. Running GenAI on AWS infrastructure answers those concerns with four benefits the exam names: security, compliance, shared responsibility, and safety. This lesson explains each one using Amazon Bedrock as the main example.

Security of Your Data

With Amazon Bedrock, your prompts and the model's responses are not used to improve the base models and are not shared with the model providers. Bedrock runs each provider's model in deployment accounts that the Bedrock service team owns and operates. The model providers have no access to those accounts, so they can't see customer prompts, completions or logs.

On top of that, the usual AWS security controls apply:

  • Encryption of data in transit and at rest.
  • AWS Identity and Access Management (IAM) to control exactly who and what can call which models.
  • Amazon VPC and AWS PrivateLink: a VPC interface endpoint gives you a private connection to Bedrock, so traffic doesn't travel over the public internet.
  • AWS CloudTrail to log API activity for auditing.

Compliance

AWS services are assessed by third-party auditors under many compliance programs. The Bedrock product page lists standards such as SOC, ISO, GDPR and FedRAMP High, and says it's HIPAA eligible. You can check which services are in scope for a given program on AWS's "services in scope" pages, and download the auditors' reports from AWS Artifact.

Being in scope helps, but it doesn't make your own application compliant automatically. How you configure and use the service is still up to you.

The Shared Responsibility Model

Security on AWS is split in two:

  • Security of the cloud is AWS's job: the hardware, data centres, networking and the software that runs the managed service.
  • Security in the cloud is the customer's job: your data, who has access to it, how services are configured, and how your application uses the model's output.

For a managed service like Bedrock, AWS runs much more of the stack than it does for a virtual server you manage yourself. But you still decide who gets IAM permissions, what data you send, and whether you turn on protections like guardrails.

Safety of Model Outputs

Amazon Bedrock Guardrails add configurable safeguards that work across different foundation models. A guardrail can filter harmful content (hate, insults, sexual content, violence, misconduct and prompt attacks), block topics you define, block specific words, and block or mask sensitive information such as personal details. It can also check whether answers are grounded in your source documents. One guardrail can protect several applications in the same consistent way.

On the Exam

Concern in the scenarioAWS answer
"Will the model provider see or train on our data?"Bedrock doesn't share prompts with providers or use them to train base models
"Traffic must not cross the public internet"VPC interface endpoint with AWS PrivateLink
"We need the auditor's report"AWS Artifact
"Block harmful replies and hide personal data"Amazon Bedrock Guardrails
"Who handles what?"Shared responsibility model
Quiz me on this
A law firm's leadership will approve a GenAI assistant only if client prompts are never used to train the underlying foundation model and are never visible to the model's provider. Which statement about Amazon Bedrock addresses this concern?
  1. Bedrock trains each model only on prompts from customers in the same industry.
  2. ✓ Prompts aren't used to train base models or shared with providers.
  3. Bedrock sends prompts to providers, but only after removing the client's name.
  4. Bedrock lets each model provider review prompts to improve safety.
A bank's security policy says traffic between its applications in a VPC and Amazon Bedrock must not travel over the public internet. What should the bank set up?
  1. An Amazon CloudFront distribution in front of Bedrock
  2. Amazon Bedrock Guardrails with a sensitive information filter
  3. Amazon Macie scans of the bank's S3 buckets
  4. ✓ A VPC interface endpoint using AWS PrivateLink
Under the AWS shared responsibility model, which task is the customer's responsibility when using Amazon Bedrock?
  1. ✓ Deciding which IAM users and roles may call which models
  2. Patching the servers that run the foundation models for Bedrock
  3. Securing the physical data centres where inference runs
  4. Maintaining the network hardware inside AWS Regions
A telecom company is launching a customer chatbot on several foundation models. It must block abusive replies, refuse questions about competitors' pricing, and mask phone numbers in responses, with the same rules applied whichever model is used. What should it use?
  1. Amazon Comprehend sentiment analysis on each reply
  2. A separate system prompt written for each model
  3. ✓ Amazon Bedrock Guardrails
  4. AWS CloudTrail logging of every request
Does Amazon Bedrock train base models on your prompts?
No. Customer content isn't used to improve base models and isn't shared with model providers.
Model deployment accounts (Bedrock)
Accounts run by the Bedrock team where provider models are hosted. Providers can't access them, so they never see prompts or logs.
Security OF the cloud vs IN the cloud
OF is AWS's job (hardware, facilities, managed service software). IN is the customer's (data, access, configuration).
Private connection from a VPC to Bedrock
A VPC interface endpoint with AWS PrivateLink, so traffic doesn't cross the public internet.
Where to download AWS compliance reports
AWS Artifact, which holds third-party audit reports such as SOC reports.