Amazon Bedrock security and compliance: how your data is handled, and what you still own.

IThe shared responsibility picture

AWS secures the service. You secure how you use it.

The AWS shared responsibility model applies to Bedrock: AWS protects the infrastructure and the service; you control your content, IAM, network setup, encryption choices, logging and the application around the model. A compliant service does not make your application compliant.

One caveat from the compliance page: AWS says its new sign-up experience is not designed for regulated workloads. If you will run regulated data, sign up with the advanced option or activate advanced account features first.

IIWhat happens to your prompts and outputs

This is the question most security reviews start with.

• Not shared, not used to train base models: The Bedrock security page says your data is not shared with model providers and is not used to improve the base models. When you fine-tune, Bedrock works on a private copy of the model.
• Providers cannot reach the model accounts: Per the data protection docs, each provider's model runs in a model deployment account owned and operated by the Bedrock team, one per provider per Region. Providers have no access to those accounts, so they cannot see Bedrock logs, prompts or completions.
• Abuse detection: Bedrock runs automated abuse detection. Read AWS's abuse detection page for what it processes, and record it in your data map.
• Cross-Region inference moves processing: If you use a cross-Region inference profile, a request can be served from another Region in the same geography. Factor that into data residency decisions.

IIIEncryption and keys

Encrypted by default, with your own keys where it matters.

AWS says data is encrypted in transit and at rest, and that you can create, manage and control keys with AWS KMS. AWS requires TLS 1.2 and recommends TLS 1.3. Use a customer managed KMS key for the resources Bedrock stores for you, such as custom models, training data, knowledge base data and batch input and output in S3, so you control key policy, rotation and revocation. FIPS endpoints are available if you need FIPS 140-3 validated modules.

IVKeeping Bedrock traffic off the internet

Use VPC endpoints.

AWS PrivateLink gives private connectivity from your VPC to Bedrock without exposing the VPC to internet traffic. Create interface VPC endpoints for the Bedrock APIs you use, attach endpoint policies that allow only the actions and models you approve, and use IAM conditions to deny calls that do not come through your endpoints.

VIAM: least privilege on actions and models

Model access is now on by default, so IAM is where you enforce your approved-model list.

• Allow only approved models: Scope invoke permissions to the model and inference profile ARNs you have approved. Deny the rest with IAM or a service control policy, because AWS enables many models by default.
• Control who can enable new models: First use of a third-party model needs AWS Marketplace subscribe permissions. Limit those to an admin role.
• Separate build and run roles: Keep permissions to create or change guardrails, knowledge bases, agents and custom models apart from the role your application uses to invoke models.

VILogging and audit

Two trails: who did what, and, if you need it, what was said.

• AWS CloudTrail: Records Bedrock API activity: who invoked or changed what, when and from where. Turn it on everywhere and keep it in a locked log account.
• Model invocation logging: Off by default. When on, Bedrock writes request and response data to CloudWatch Logs or S3. Use it when you need a content audit trail, and treat those logs as sensitive data with their own encryption, access and retention rules.
• CloudWatch metrics: Track invocations, token counts, throttles and Guardrails interventions, and alarm on unusual usage.

VIICompliance programs, and the caveat

Check scope for your exact framework and Region.

Use AWS Services in Scope by Compliance Program to confirm a framework, and AWS Artifact for the reports your auditor will ask for.

VIIIGuardrails: the content and PII layer

Platform security protects the data. Guardrails control what goes in and out of the model.

Bedrock Guardrails add content filters (including prompt attacks), denied topics, word filters, sensitive information filters that block or mask PII, contextual grounding checks and Automated Reasoning checks. One versioned guardrail can apply to every model, to agents, and through the ApplyGuardrail API to models outside Bedrock. For regulated data, masking PII before it is logged is often the control auditors ask about first.

IXA Bedrock security checklist

What a reviewer will want to see.

• Account setup: Regulated workloads on an account with advanced features; MFA everywhere; IAM Identity Center for people.
• Data use: Document AWS's statements on data use and model deployment accounts, plus where cross-Region inference may process data.
• Encryption: Customer managed KMS keys on custom models, training data, knowledge bases and batch S3 buckets.
• Network: Interface VPC endpoints with endpoint policies; deny calls from outside them.
• IAM: An approved-model list enforced in IAM or SCPs; separate build and run roles; Marketplace subscribe rights limited.
• Logging: CloudTrail always; invocation logging only where needed, with encryption, access and retention set.
• Guardrails: A versioned guardrail on user-facing and regulated paths, with PII masking and prompt attack filtering.
• Compliance: Scope confirmed in Services in Scope; reports from AWS Artifact; a BAA if you handle PHI.

XWho can file AWS funding for a Bedrock build

There are two kinds of AWS money for a Bedrock build. A partner files one. You apply for the other yourself.

Partner-filed funding. An AWS consulting partner can file POC (proof of concept) funding to test a Bedrock workload, whether or not you run on AWS today. If you already run on AWS and are adding new AI work, the partner can file incremental workload (IW) funding instead. For startups this is often $50K to $150K. Depends on the workload; AWS approves. The work has to be real, and the partner has to be the one doing it.

AWS Activate, which you apply for yourself. Activate Founders gives $1,000 to start, up to $5,000, with no investor needed. Activate Portfolio gives up to $200,000 if your VC, accelerator or angel group is an Activate Provider and gives you its Org ID. A consulting partner cannot apply for Activate on your behalf. AWS made Activate credits usable for third-party models on Bedrock in April 2024.

For most startups without a VC, the partner route is the larger of the two. Security reviews are partner work, so it helps to pick a partner who has shipped regulated Bedrock workloads. CloudRoute matches you with one vetted AWS partner for free. Partners pay CloudRoute a monthly membership plus 10% of AWS-approved funding.