AWA AIF-C01 - Domain 5 - Security, Compliance, and Governance for AI Solutions

Protecting AI systems, models, data, applications, and infrastructure against unauthorized access, misuse, manipulation, and attacks.

Policies, processes, controls, and responsibilities used to manage AI systems throughout their lifecycle.

Policies and practices for managing data availability, usability, integrity, security, privacy, and compliance.

Protecting personal and sensitive information from inappropriate collection, processing, access, disclosure, or use.

The physical or geographic location where data is stored or processed.

The principle that data is subject to the laws and regulations of the country or jurisdiction where it is located.

Transforming data into an encoded form so it cannot be understood without the appropriate decryption mechanism.

Protecting stored data through encryption while it is not actively being transmitted.

Protecting data while it moves between systems, networks, or services.

An AWS service for creating and controlling cryptographic keys used to protect data and resources.

An AWS service for securely controlling access to AWS resources through identities, policies, roles, and permissions.

Granting users, applications, and services only the permissions required to perform their intended tasks.

An AWS identity with permissions that can be assumed by trusted users, applications, or AWS services.

A document that defines permissions specifying which actions are allowed or denied on which resources.

Verifying the identity of a user, application, or system.

Determining which actions or resources an authenticated identity is permitted to access.

Requiring two or more authentication factors to verify an identity.

Mechanisms that determine who or what can access resources and what actions they are permitted to perform.

An attack that attempts to manipulate an AI model by supplying malicious or conflicting instructions through input or retrieved content.

Attempts to circumvent a model's built-in safety controls or restrictions through specially crafted inputs.

Introducing malicious, incorrect, or manipulated data into training or other data sources to influence model behavior.

Manipulating a model or its training process so that the resulting model behaves in an unintended or malicious way.

Deliberately crafted inputs designed to cause an AI model to produce incorrect, unsafe, or unintended results.

An input intentionally modified in a way that can cause a machine learning model to make an incorrect prediction or classification.

Unauthorized acquisition or reproduction of a model, its parameters, behavior, or capabilities.

An attack that attempts to infer sensitive information about the training data from a model's behavior or outputs.

An attack that attempts to determine whether a particular data record was included in a model's training dataset.

Unintended disclosure of system prompts, hidden instructions, or other information supplied to an AI model.

Exposure of confidential, personal, proprietary, or otherwise protected information through an AI system or its outputs.

An AWS service that uses machine learning and pattern matching to discover and help protect sensitive data in Amazon S3.

An AWS service that records API activity and actions taken in an AWS environment for auditing, monitoring, and governance.

An AWS monitoring and observability service used to collect metrics, logs, and other operational information.

A service that continuously records and evaluates resource configurations to support compliance, auditing, and governance.

An AWS service that helps collect evidence and continuously audit AWS usage against compliance frameworks and requirements.

A self-service portal providing access to AWS security and compliance reports and agreements.

Controls that help filter harmful content, deny selected topics, and protect sensitive information when building generative AI applications with Amazon Bedrock.

A capability for logging model invocation inputs and outputs to support monitoring, auditing, and troubleshooting.

Meeting applicable laws, regulations, standards, contractual obligations, and organizational policies.

A chronological record of system activity that can be used to reconstruct events, investigate incidents, and demonstrate compliance.

AWS and the customer share responsibility for security and compliance: AWS secures the underlying cloud infrastructure, while customers remain responsible for security tasks within their use of AWS services.