AWS AI Security
Bedrock & SageMaker Security From Day One.
What this hub covers
AI workloads add four control surfaces traditional compliance frameworks did not contemplate: knowing what AI exists across accounts (Security Hub AI inventory — managed Bedrock/AgentCore/SageMaker via Config, self-hosted stacks via Inspector SBOM, external model APIs via GuardDuty DNS), prompt-injection and PII leakage in inference paths, training-data lineage and consent, and model governance. The guides below cover inventory-backed discovery, Bedrock Guardrails (PII redaction, text and image content filters, denied topics, word filters, contextual grounding, and Automated Reasoning checks — all HIPAA-eligible), HIPAA-eligible AI architectures including Bedrock AgentCore, and GenAI governance for regulated industries.
8 guides in this hub
Each one is written for a production AWS estate: the configuration, the trade-offs and what the auditor asks for. Part of the AWS Security & Compliance hub.
How to Set Up Amazon Bedrock Guardrails for Production
Amazon Bedrock Guardrails protect foundation models from harmful outputs by filtering prompt injection, jailbreaks, toxicity, and PII. This guide covers setup, testing, cost optimization, and production safety patterns for GenAI applications.
Read the guideHIPAA-Compliant AI on AWS Bedrock: A Production Guide for Healthcare Workloads
Production guide for HIPAA-compliant generative AI on AWS Bedrock: BAA scope, eligible models, Guardrails for PHI redaction, Knowledge Bases for RAG over clinical data, VPC isolation, and the audit evidence package OCR investigators expect.
Read the guideImplementing GenAI Guardrails: A Guide to Secure AI Governance in AWS Environments
Deploying GenAI without guardrails is a compliance incident waiting to happen. This post covers how to build a production-grade AI governance layer on AWS using Amazon Bedrock Guardrails, least-privilege IAM, and continuous evaluation.
Read the guideAmazon Bedrock Automated Reasoning Checks: Production Hallucination Prevention with Math-Validated Factuality
Bedrock Automated Reasoning checks ground LLM outputs against formal logic policies you encode and mathematically validate that the response is consistent with the policy. This guide covers when to use Automated Reasoning vs contextual grounding, how to author the policy in production, the integration with Bedrock Guardrails, and the regulated use cases (HR, insurance, eligibility, regulatory determinations) where the difference matters.
Read the guideHow to Set Up AWS Security Hub for Compliance Monitoring
AWS Security Hub aggregates security findings from 200+ sources and, as of Jul 14 2026, includes AI inventory for org-wide AI assets. This guide covers setup, compliance standards, AI inventory, automated remediation, and a compliance dashboard without hiring a SOC team.
Read the guideHow to Secure AI Agents Connected to Your eCommerce Store (2026)
Store-connected agents fail at secrets, PII, and payment tools, not at prompts. Support-shaped pilots tracked roughly 3× spend when a browser tool stayed on for lookup turns. Delete payment tools.
Read the guideMCP Security for Enterprise Commerce Agents (2026)
MCP is a tool pipe. The 2025-11-25 spec requires OAuth 2.1 and Protected Resource Metadata on HTTP. A local stdio server must not pretend that flow applies. Tool descriptions are not a permission boundary.
Read the guideAI Agent Identity for eCommerce: Who Is Calling the Tool (2026)
Three identities, not one token. The workload role, the shopper or associate, and the downstream API account. A shared admin credential fails the split. AgentCore Identity does not replace your order-system scopes.
Read the guideServices and neighbouring hubs
The engagements that apply these guides, in navy, and the hubs buyers usually read alongside this one.
Cyber-Led AI Security Readiness Check
Secure your AWS environment before deploying AI. Free Cyber-Led AI Readiness Check covers IAM, SageMaker, S3, and GPU risks. SMB-focused. Fix in weeks.
Explore the serviceCloud Compliance Services — HIPAA, SOC 2, PCI DSS on AWS
Cloud compliance services — HIPAA, SOC 2, PCI DSS, ISO 27001, GDPR. Expert consulting from FactualMinds.
Explore the serviceCompliance Frameworks
Framework-by-framework guidance — what auditors expect, what AWS provides, and what your team configures.
Open the hubData Security
Bucket-level controls, secret rotation, KMS post-quantum, Amazon Macie for data classification, and clean-room collaboration without raw-data sharing.
Open the hubThreat Detection & Response
Continuous monitoring, Security Hub AI inventory, agentless vulnerability scanning, OCSF data lakes, and automated remediation.
Open the hubCommon questions
- How do we find unsanctioned AI across accounts?
- Start with Security Hub AI inventory (included with Security Hub Essentials as of 14 July 2026 — no extra cost or enablement). It continuously catalogs managed AI from AWS Config (Bedrock, Bedrock AgentCore, SageMaker), self-hosted inference on EC2 and ECR via Inspector SBOM (Ollama, vLLM, Hugging Face TGI, and others), and third-party model API endpoints via GuardDuty DNS telemetry. Filter by account, discovery method, and model identity; prioritize assets correlated with active GuardDuty findings. Inventory tells you what exists — it does not replace Guardrails, prompt-injection testing, or architecture review.
- Do Bedrock Guardrails replace prompt-injection testing?
- No — Guardrails are a runtime defence, not a substitute for adversarial testing. Guardrails block known-bad output classes (PII leakage, denied topics, content categories, off-topic queries, ungrounded responses) on every inference, but a sufficiently novel prompt-injection chain can still induce harmful behaviour the guardrail does not pattern-match. The right pattern: deploy Guardrails for steady-state defence, run quarterly adversarial red-team exercises (manual + tools like garak, PyRIT, or AWS Bedrock Evaluations adversarial suites), and feed every confirmed bypass back into the Guardrail policy as a denied topic, regex, or grounding rule. NIST AI RMF and the EU AI Act Annex III both require ongoing risk assessment — point-in-time testing alone does not satisfy either.
- How does Bedrock Automated Reasoning differ from contextual grounding?
- Contextual grounding compares the model output against the retrieval-augmented source documents and rejects responses that are not corroborated — the right tool for "did you cite something we provided?" Since October 2026 its Standard tier also scores reasoning and conversational responses at the same price as Classic. Automated Reasoning compares the model output against a formal logic policy you encode (rules, constraints, allowed conclusions) and mathematically validates that the output is consistent with the policy — the right tool for "is this answer logically valid given our business rules and regulations?" Use grounding for retrieval-augmented generation over your knowledge base; use Automated Reasoning when the answer must satisfy explicit rules (HR policy, insurance underwriting, regulatory determinations, eligibility logic) where a hallucinated correct-sounding answer would be a liability. AWS reports ~99% validated-response accuracy on the public benchmark; production accuracy depends on policy completeness.
- Is Amazon Bedrock HIPAA-eligible — including AgentCore?
- Yes. Amazon Bedrock has been HIPAA-eligible (covered by the AWS BAA) since 2023, and AWS added Bedrock AgentCore to the HIPAA Eligible Services list in February 2026. Confirm the model you use is HIPAA-eligible (most foundation models on Bedrock are; some third-party models opted out) by checking the AWS HIPAA Eligible Services page for the current list. The Guardrails feature itself is HIPAA-eligible — including the PII redaction, content filters, contextual grounding, and Automated Reasoning checks. Your responsibility: encrypt traffic in transit (Bedrock supports ML-KEM hybrid TLS), encrypt logs at rest with KMS-CMK, scope IAM permissions to the minimum, and keep prompt and response logs only for the period your data-retention policy permits.
Apply this to your environment
Our consulting engagements apply this guidance to your specific environment, regulatory scope and threat model.
Pictures:Lock and Key (public domain (CC0)); Lock and Key (public domain (CC0)); Coffer lock and key (public domain (CC0)); Padlock and key, André Omereler (public domain (CC0)); Padlock, French (?) maker (public domain (CC0)); Chubb lock (public domain); Safe deposit vault 1908, The Cleveland Trust Company (public domain); The Street Locksmith (6899206616), John Thomson (no known copyright restrictions).Via The Metropolitan Museum of Art and Wikimedia Commons.
.jpg){kind=link}