Security, Compliance, and Governance for AI Solutions
This domain applies core AWS security and governance practices to AI workloads: controlling access, protecting data, and demonstrating compliance. It is about one in seven scored questions. Many answers come down to identifying the right AWS service, so know what each governance service does.
Access control and least privilege
AWS Identity and Access Management (IAM) controls who can access which resources and what actions they may perform, including AI services such as Amazon Bedrock and SageMaker. The principle of least privilege says to grant each user or service only the minimum permissions its task requires, and nothing more. Broad administrator access, shared root credentials, and disabled controls all widen the potential blast radius of a breach and should be avoided.
The shared responsibility model
Under the AWS shared responsibility model, AWS secures the cloud infrastructure (security 'of' the cloud), while the customer is responsible for how they configure and use it (security 'in' the cloud), including their data, access policies, and settings. For a managed service like Amazon Bedrock, AWS runs and secures the underlying platform, but you remain responsible for your data, permissions, and appropriate usage.
Protecting data
Encrypting data both at rest and in transit keeps sensitive training data and model inputs and outputs unreadable if they are intercepted or accessed without authorization; it complements, not replaces, access controls. Amazon Macie automatically discovers and classifies sensitive data such as personally identifiable information stored in Amazon S3. Data privacy also means being deliberate about what data is sent to a model and where it is stored.
Compliance, auditing, and governance services
AWS CloudTrail records API calls and account activity, creating an audit trail for security analysis and investigations. AWS Config continuously records resource configurations and evaluates them against rules to track compliance and detect drift. Together they help answer the governance questions of who did what, when, and whether resources meet policy.
Data governance for AI
Governance emphasizes the provenance and quality of the data used to train or customize a model, because the origin, accuracy, and appropriateness of that data directly affect reliability, fairness, and legal compliance. Poor or improperly sourced data can create bias, errors, and legal exposure. Good governance documents where data came from and how it may be used, rather than discarding those records.