AIF-C01 Domain 5 - AI Security Compliance and Governance
Domain 5 is 14% of the scored AWS Certified AI Practitioner (AIF-C01) exam. It tests security controls, data lineage, hallucination grounding, audit evidence, and governance processes.
Secure the AI lifecycle
- Identity and access: use AWS Identity and Access Management (IAM) roles, short-lived credentials, least privilege, separation of duties, and resource policies. Limit which models, data sources, tools, and actions an agent can use.
- Secrets: store API keys and credentials in AWS Secrets Manager, not prompts, code, notebooks, logs, or model context.
- Encryption: use AWS Key Management Service (KMS) and service encryption for data at rest; use TLS for data in transit.
- Network isolation: use Amazon VPC, security groups, VPC endpoints/AWS PrivateLink, and controlled egress when private connectivity is required.
- Data protection: discover/classify sensitive S3 data with Amazon Macie, minimize collection, apply retention/deletion rules, and mask/tokenize/anonymize with appropriate processing tools.
- Vulnerability and threat management: use Amazon Inspector for supported workload/package vulnerability scanning and monitor logs/alerts with Amazon CloudWatch.
Under the AWS Shared Responsibility Model, AWS secures the cloud infrastructure; the customer remains responsible for data, identities, access policies, prompts, model/application configuration, output use, and many workload controls. The boundary varies by service abstraction.
AI-specific threats and controls
| Risk | Typical controls |
|---|---|
| Prompt injection/jailbreak | separate instructions from untrusted content, filters, least-privilege tools, allow lists, approval gates |
| Data or prompt leakage | data minimization, access-aware retrieval, redaction, output filtering/validation, logging controls |
| Poisoned training/RAG data | provenance, signed/controlled sources, integrity checks, reviews, anomaly detection |
| Toxic or unsafe output | Bedrock Guardrails, domain rules, moderation, human escalation |
| Excessive agent action | AgentCore Identity/Policy, scoped credentials, deterministic business rules, transaction limits |
| Hallucination | RAG grounding, citations, confidence/evidence checks, deterministic validation, human review |
Amazon Bedrock AgentCore provides modular runtime, identity, gateway, memory, observability, and policy capabilities. Policy provides deterministic authorization boundaries around tool use; the model should not decide its own permissions.
Grounding and hallucination detection
- Retrieve evidence from trusted sources and preserve citations.
- Validate claims, structured output, and tool results against authoritative systems.
- Require answers to identify insufficient evidence rather than inventing detail.
- Use confidence/evidence thresholds and route uncertain/high-impact cases to humans.
- Test hallucination and groundedness on representative adversarial and edge cases.
A citation is evidence only if it actually supports the claim. RAG lowers some factual risk; it does not guarantee correctness.
Data lineage and documentation
- Data lineage: where data came from, how it changed, and where it was used.
- Data catalog: searchable metadata about datasets, schemas, classifications, ownership, and location; AWS Glue Data Catalog stores metadata, not the underlying data.
- Model card: purpose, owner, versions, training/evaluation data, metrics, risks, intended use, and limitations.
- Record prompts, model/configuration versions, retrieval sources, tool calls, approvals, and output events at a privacy-appropriate level for reproducibility and audit.
Governance and compliance
Governance defines decision rights, policies, risk tiers, approved models/data, review cadence, deployment gates, monitoring, incident response, retention/residency, and training requirements. Standards and laws such as ISO/SOC frameworks or algorithm-accountability rules inform obligations; using an AWS service does not itself make a workload compliant.
The AWS Generative AI Security Scoping Matrix helps classify how much of the generative-AI stack the organization controls, from consuming a third-party application through building/training models. More ownership creates more security responsibilities.
Service matching
| Need | AWS service |
|---|---|
| Download AWS compliance reports/agreements | AWS Artifact |
| Collect audit evidence against controls | AWS Audit Manager |
| Record API/user/service activity | AWS CloudTrail |
| Record configuration history and evaluate rules | AWS Config |
| Workload metrics, logs, alarms, dashboards | Amazon CloudWatch |
| Workload vulnerability scanning | Amazon Inspector |
| Sensitive-data discovery/classification in S3 | Amazon Macie |
| Best-practice recommendations | AWS Trusted Advisor |
| Architecture review against lenses | AWS Well-Architected Tool |
| Encryption-key control | AWS Key Management Service (KMS) |
| Identity policies and roles | AWS Identity and Access Management (IAM) |
Current-status note: AWS Audit Manager entered maintenance mode for new account/Region setup on April 30, 2026. Existing configured customers remain supported; current migration guidance points toward AWS Config-based compliance management where appropriate.
Governance process
- Inventory the use case, stakeholders, models, data, integrations, and jurisdictions.
- Classify risk and prohibited/approved use.
- Define owners, policies, controls, acceptance metrics, and review gates.
- Document data/model lineage, licenses, residency, retention, and access.
- Test security, privacy, bias, safety, groundedness, and failure paths.
- Approve and deploy with least privilege, logging, monitoring, and rollback.
- Review on a schedule and after model/data/prompt/tool changes or incidents.