AWS Services and Features for Securing AI Systems

AI models process sensitive dataCopy Anchor Link

First, AI models often process sensitive data, such as personal information, financial records, or proprietary business data. Failing to secure these systems can lead to data breaches, privacy violations, and potential legal and financial consequences.

• 1
• 2
• 3
• 4
• 5

The AWS Shared Responsibility ModelCopy Anchor Link

Security and compliance is a shared responsibility between AWS and the customer. The shared model helps relieve the customer’s operational burden. AWS operates, manages, and controls the host operating system and virtualization layer down to the physical security of the facilities in which the service operates.

The customer assumes responsibility and management of the guest operating system. This includes updates, security patches, and other associated application software, in addition to the configuration of the AWS provided security group firewall.

Customers should carefully consider the services they choose. Their responsibilities vary, depending on the services used, the integration of those services into their IT environment, and applicable laws and regulations. The nature of this shared responsibility also provides the flexibility and customer control that permits the deployment.

As shown in the following chart, this differentiation of responsibility is commonly referred to as security of the cloud compared to security in the cloud.

2: Customer responsibility

2: Customer responsibilityCopy Anchor Link

Customers are responsible for the following:

• Customer data
• Platform, applications, identity and access management
• Operating system, network and firewall configuration
• Client-side data encryption and data integrity authentication
• Server-side encryption (including file system and data)
• Networking traffic protection (including encryption, integrity, identity)

AWS services for securing AI systemsCopy Anchor Link

Defense in depth security

Recall that the defense in depth was briefly described at the beginning of this course. The goal of this strategy is to provide multiple layers of security around your data and workloads.

If one layer is compromised, the other layers will isolate, slow down, or stop a threat actor. The multiple layers prevent the threat actor from moving laterally, escalating privileges, exfiltrating or manipulating data, and so on.

Getting started with defense in depthCopy Anchor Link

There are four foundational AWS security services recommended for any workload, any customer, and any industry. You can realize benefits from implementing these deeply-integrated foundational security services, such as the following:

• Security Hub
• AWS KMS
• GuardDuty
• AWS Shield Advanced

Each service provides protection in one of the core security domains of incident response, data protection, threat detection, and network and application protection.

AWS KMS

AWS KMS encrypts data and gives customers the choice and control of using AWS managed keys or customer-managed keys to protect their data.

For more information, see AWS Key Management Service.

AWS Security Hub

AWS Security Hub provides customers with a single dashboard to view all security findings, and to create and run automated playbooks.

For more information, see AWS Security Hub.

Amazon GuardDuty

Amazon GuardDuty is a threat detection service that monitors for suspicious activity and unauthorized behavior to protect AWS accounts, workloads, and data.

For more information, see Amazon Guard Duty.

AWS Shield Advanced

Amazon GuardDuty is a threat detection service that monitors for suspicious activity and unauthorized behavior to protect AWS accounts, workloads, and data.

For more information, see Amazon Guard Duty.

AWS security services

AWS provides several services and features for securing AI systems. The following services are used to manage user identities and access to resources, identify and protect sensitive data, and guard your AI systems and applications.

Identify sensitive data before training modelsCopy Anchor Link

Amazon Macie uses ML to automate sensitive data discovery at scale.

You can use Amazon Macie to scan S3 buckets for personally identifiable information (PII), personal health information (PHI), financial information, and other sensitive data. You can determine whether you need to remove the data or whether it needs more security protections before training or fine-tuning models.

You can also scan databases by extracting data to a data lake in Amazon S3 to then have Amazon Macie scan the database content.

For more information, see the Amazon Macie User Guide.

Manage identities and access to AWS services and resourcesCopy Anchor Link

With AWS Identity and Access Management (IAM), you can specify who or what can access services and resources in AWS. You can also centrally manage fine-grained permissions, and analyze access to refine permissions across AWS. Here are some IAM entities that you can create:

• IAM users and IAM user groups: An IAM user is an entity that you create in AWS. The IAM user represents the human user or workload who uses the IAM user to interact with AWS. A user in AWS consists of a name and credentials. An IAM user group is a collection of IAM users. User groups let you specify permissions for multiple users, which can make it more convenient to manage the permissions for those users.
• IAM roles: An IAM role is an IAM identity that you can create in your account that has specific permissions. An IAM role is similar to an IAM user, in that it is an AWS identity with permission policies that determine what the identity can and cannot do in AWS.
• IAM policies: A policy is an entity that, when attached to an identity or resource, defines their permissions.

For more information, see AWS Identity and Access Management and the AWS Identity and Access Management User Guide.

Limit access to your data, models, and outputsCopy Anchor Link

Apply a policy of least privilege to training data, models, and applications using AWS IAM Identity Center and IAM Access Analyzer. Here are some other services you can use to limit access:

• Explore further zero trust capabilities to add fine-grained access controls with AWS Verified Access and Amazon Verified Permissions.
• Use AWS Verified Access to further eliminate the costs, complexity and performance issues related to virtual private networks (VPNs).

You can use Amazon SageMaker Role Manager to build and manage persona-based IAM roles for common ML needs.

Amazon SageMaker Role Manager provides three preconfigured role personas and predefined permissions for common ML activities. These role personas are as follows:

• Data scientist persona
• MLOps persona
• SageMaker AI compute persona

For more information, see the following resources:

• AWS IAM Identity Center
• AWS IAM Access Analyzer
• AWS Verified Access
• Amazon Verified Permissions
• Amazon SageMaker Role Manager
• Ensure Least Privilege Access

Protect data from exfiltration (data theft) and manipulationCopy Anchor Link

For strong controls over data ingress and egress from AI systems, you can define strict AWS Network Firewall and Amazon VPC policies. This will prevent the movement of data in and out of your VPCs and networks. Here are some more services you can use to control data entering and leaving your AI systems:

• AWS Network Firewall supports deep packet inspection to decrypt, inspect, and re-encrypt inbound and outbound TLS traffic to protect data. Data destined for the internet, another VPC, or another subnet is supported.
• Amazon Virtual Private Cloud (Amazon VPC) lets you launch AWS resources in a logically isolated virtual network that you've defined. This virtual network closely resembles a traditional network that you would operate in your own data center, with the benefits of using the scalable infrastructure of AWS.
• You can use AWS PrivateLink to establish private connectivity from your Amazon VPC to Amazon Bedrock, without having to expose your VPC to internet traffic.

For more information, see the following resources:

• AWS Network Firewall
• Amazon Virtual Private Cloud
• What is AWS PrivateLink?

Protect AI workloads with intelligent threat detectionCopy Anchor Link

In addition to Amazon GuardDuty, Amazon Inspector and Amazon Detective can help with intelligent threat detection. These services help identify suspicious activity such as AWS credential exfiltration (theft) and suspicious user API usage, including Amazon Bedrock and Amazon SageMaker AI APIs. Following is a brief description of Amazon Inspector and Amazon Detective:

• Amazon Inspector is an automated vulnerability management service that continually scans AWS workloads for software vulnerabilities and unintended network exposure.
• Amazon Detective streamlines the investigative process and helps security teams conduct faster and more effective forensic investigations.

For more information, see the following resources:

• Amazon Inspector
• Amazon Detective

Automate incident response and complianceCopy Anchor Link

By automating security tasks on AWS, you can be more secure by reducing human configuration errors. This gives your team more time to focus on other work critical to your business. Task automation makes it more convenient for your security team to work closely with developer and operations teams to create and deploy code faster and more securely.

For example, by employing technologies like ML, you can automatically and continuously discover, classify, and protect sensitive data in AWS.

You can also automate infrastructure and application security checks to continually enforce your security and compliance controls and help ensure confidentiality, integrity, and availability at all times.

You can automate incident response and compliance with AWS services that you learned about earlier, such as the following:

• AWS Security Hub
• AWS Config
• AWS Audit Manager
• AWS Artifact

Defend your generative AI web applications and dataCopy Anchor Link

In addition to AWS Shield Advanced and AWS Firewall Manager, which you learned about earlier, you can also use AWS WAF to protect your web applications and data.

AWS WAF helps you protect against common web exploits and bots that can affect availability, compromise security, or consume excessive resources. With AWS WAF you can do the following:

• Filter web traffic.
• Prevent account takeover fraud.
• Use AWS WAF Bot Control to control pervasive bot traffic (such as scrapers, scanners, crawlers). Pervasive bot traffic can consume excess resources, skew metrics, cause downtime, or perform other undesired activities. For more information, see AWS WAF Bot Control.

Additional resourcesCopy Anchor Link

For more information about the Shared Responsibility Model and AWS cloud security in general, see the following resources.

Shared Responsibility Model

To learn more about the AWS Shared Responsibility Model, choose the following link.

AWS Webpage

AWS Cloud Security

To learn more about AWS cloud security in detail, choose the following link.

AWS webpage

Next, you will learn about data and model lineage.