Security · Topic 5 of 6

Securing Access, Privacy and Logs for AI Services

Control who can call Amazon Bedrock and other managed AI services, keep prompts on a private network, and stop sensitive content leaking into logs.

  • 5 min
In a nutshell
  • Calling an AI service is an IAM permission on a specific action and resource.
  • Third party Bedrock models need Marketplace permissions on first use. Anthropic models also need the use case form.
  • Block a model by denying bedrock:InvokeModel, not just the Marketplace action.

What it is

When your application calls a managed AI service, three security questions come up. Who is allowed to call the model? Does the traffic stay on a private network? Do the prompts and answers end up somewhere they should not?

This page covers Amazon Bedrock and the other managed AI services in scope (Amazon Textract, Amazon Transcribe and Amazon Comprehend). It is written from the view of the developer who calls them, not the person who selects models.

Appin a VPCbedrock runtime endpointInterface endpointPrivateLinkIAM checkedBedrockmodel runslogging optionalLogsCloudWatch or S3

How it works

Request and manage access

Access to AI services is plain IAM. A role needs the action for the service it calls, scoped to the resource.

  • Bedrock inference: bedrock:InvokeModel and bedrock:InvokeModelWithResponseStream. The Converse API is authorized with these same actions. Scope the Resource to a foundation model ARN, or to an inference profile ARN together with the models it routes to.
  • Other AI services: actions such as textract:AnalyzeDocument, transcribe:StartTranscriptionJob and comprehend:DetectPiiEntities. Asynchronous Comprehend jobs use a data access role that Comprehend assumes to read and write S3.

Access to many Bedrock models in commercial Regions is enabled on first use. For third party models sold through AWS Marketplace, the first invocation starts a subscription in the background, and the calling role needs aws-marketplace:Subscribe, aws-marketplace:Unsubscribe and aws-marketplace:ViewSubscriptions. After the model is enabled, callers no longer need those Marketplace permissions. Amazon models are not sold through Marketplace.

Anthropic models also need a one time first use case form per account (or once at the organization's management account), submitted in the console or with PutUseCaseForModelAccess. Until the agreement finishes, calls return AccessDeniedException. GetFoundationModelAvailability shows the status.

To block a model, deny bedrock:InvokeModel for it with an SCP or IAM policy. Denying only aws-marketplace:Subscribe does not stop the first call.

Private connectivity and data privacy

An interface VPC endpoint (AWS PrivateLink) lets code in a VPC call Bedrock without an internet gateway, NAT device or public IP address.

Endpoint serviceUsed for
bedrock-runtimeInvokeModel and Converse
bedrockControl plane calls such as managing guardrails
bedrock-agent-runtimeCalling agents and knowledge bases
bedrock-agentBuilding agents and knowledge bases

The full service name has the form com.amazonaws.<region>.bedrock-runtime. With private DNS enabled, the usual hostname resolves to the endpoint and no code change is needed. Without it, set the endpoint URL in the SDK client. An endpoint policy can limit which principals and actions may use the endpoint.

On training and sharing, the Bedrock FAQ states that inputs and outputs are not used to train Amazon or third party models and are not shared with model providers. Model providers have no access to the accounts that run the models.

Content is encrypted at rest and in transit, and TLS 1.2 is required.

Protecting logs

Model invocation logging is off by default. When you turn it on, Bedrock writes full prompts and responses to CloudWatch Logs, Amazon S3 or both. The destination must be in the same account and Region. Large bodies and images go to S3.

Those logs now hold whatever users typed, including PII. Treat them as sensitive data.

  • Encrypt the S3 bucket or log group with a customer managed KMS key.
  • Limit read access with IAM and the key policy.
  • Add a CloudWatch Logs data protection policy to mask PII and credentials in the log group.
  • Content blocked by a guardrail appears in plain text in invocation logs. Turn logging off, or restrict it, if that is not acceptable.
  • A guardrail trace returns unmasked values. Do not write it to ordinary application logs.
  • Do not put PII in the optional requestMetadata, in tags, or in resource names, because those can appear in billing and diagnostic data.
User promptcontains PIIlogged by BedrockCloudWatch LogsKMS encryptedmasked by policyAnalystsees masked text

How the exam asks about this

  • "A function in private subnets must call Bedrock without internet access" -> an interface VPC endpoint for bedrock-runtime.
  • "A new developer gets AccessDeniedException when invoking a third party model the first time" -> missing AWS Marketplace permissions, or for Anthropic models the use case form is not complete.
  • "Prompt logs must not expose customer data to analysts" -> encrypt the log group with KMS and apply a data protection policy.

What to remember for the exam

  • Calling an AI service is an IAM permission on a specific action and resource.
  • Third party Bedrock models need Marketplace permissions on first use. Anthropic models also need the use case form.
  • Block a model by denying bedrock:InvokeModel, not just the Marketplace action.
  • Use interface VPC endpoints for private access. The runtime endpoint is bedrock-runtime.
  • Bedrock inputs and outputs are not used to train models and are not shared with model providers.
  • Invocation logging is disabled by default and stores full prompts. Encrypt, restrict and mask it.
Watch out

Turning on invocation logging to debug a problem creates a store of customer prompts. Decide who may read it and how long it is kept before you enable it.

Common mistakes

Allowing bedrock:* on all resources. Scope the policy to the models and actions the application needs.

Assuming a VPC endpoint blocks other routes. The endpoint adds a private path. Without a restrictive endpoint policy or route design, other paths can still exist.

Logging prompts without a plan. Full prompt logging can capture PII and credentials that users paste into a chat.

Check yourself

  • How can a Lambda function in a private subnet call Bedrock without a NAT gateway?

    Create an interface VPC endpoint for bedrock-runtime and call Bedrock through it.

  • Which two things can cause AccessDeniedException on the first call to an Anthropic model?

    Missing AWS Marketplace permissions, or the first time use case form was not submitted or is still pending.

  • Where do Bedrock prompts and responses go when invocation logging is on?

    To the CloudWatch Logs group, the S3 bucket, or both, that you configured in the same account and Region.

Topic 5 of 6 in Security

Test yourself on Security

The full AWS DVA-C03 question bank has 850 questions, with timed practice exams and an explanation for every answer.

Get Full AccessTry Sample Exam

This study guide is independent and is not affiliated with, endorsed by, or sponsored by AWS. Vendor names, certification names and exam codes are trademarks of their respective owners and are used for identification only.