Skip to content

Skill 4.3.7: Identify and Mitigate Security Risks and Vulnerabilities in ML and AI Systems

Task 4.3: Operating, Monitoring, and Securing ML and AI Solutions – Secure ML and AI Workloads and Model Endpoints

Primary objective: Protect confidentiality, integrity, availability, and compliance across ML/AI data, models, endpoints, pipelines, and prompts/responses.
Core rule: Every ML/AI object gets its own identity, network, encryption, audit, and content-safety control. One control never substitutes for another.

Security Control Layers

Layer AWS controls Purpose
Identity IAM roles, STS, permission boundaries, Secrets Manager Least privilege; separate human vs workload identity
Network VPC, subnets, SGs, NACLs, PrivateLink Isolate training, notebooks, endpoints, model calls
Data KMS, S3 policies, Macie, EBS/S3 encryption Encrypt, classify, restrict artifacts and datasets
Pipeline CodeGuru Security, Inspector, Config Find code, image, dependency, config vulnerabilities
Runtime Bedrock Guardrails, endpoint policies, throttling Filter prompts/responses; protect model invocation
Audit CloudTrail, Config, CloudWatch, invocation logging Detect, investigate, prove compliance

ML/AI Threat Matrix

Risk Detection Mitigation
Data poisoning Data validation, provenance, Macie, Config Curated datasets, S3 least privilege, encryption, lineage
Model poisoning/backdoor Model Registry approvals, artifact checksums Restrict artifact S3, KMS, VPC endpoints, validate external models
Prompt injection/jailbreak Guardrails, CloudWatch logs, anomaly alarms Guardrails, input validation, least privilege for agents/tools
Model inversion/extraction Invocation logs, throttling alarms Rate limiting, IAM auth, private endpoints, minimize PII in training
Supply chain Inspector, CodeGuru Security Scan images/deps, approved registries, SBOM, rebuild base images
Data leakage Guardrails sensitive info, Macie, log review Mask/block PII, log scrubbing, KMS, access controls
Over-permissive access IAM Access Analyzer, Config Least privilege, permission boundaries, specific actions/resources
Public endpoint Config, Inspector VPC-only endpoints, PrivateLink, IAM auth, disable public access

Identity & Credentials

  • Least privilege: Grant only required actions on required resources. Do not widen policies to clear AccessDenied.
  • Separate identities: Human users vs workload roles. Applications assume IAM roles.
  • Secrets: Store in Secrets Manager; rotate. Never hardcode in code, images, or env files.
  • Bedrock access: Production uses IAM roles with temporary credentials. API keys are for exploration/dev.
Credential Use Exam note
IAM role temporary credentials Production workloads, EC2/ECS/Lambda, SageMaker Recommended; auto-rotated
Short-term Bedrock API key Exploration; inherits generating identity; expires with session Convenient, not production
Long-term Bedrock API key Dev/exploration; own identity with expiry AWS documents for exploration/development
Secrets Manager secret Third-party API keys, DB creds Retrieve at runtime; rotate
Hardcoded/env secret Never Critical anti-pattern

Gotcha: Production foundation-model access belongs on an IAM role with temporary credentials. Long-term API keys and embedded secrets are distractors.

Network Isolation & Private Access

Requirement Configuration Trap
Private subnet with no internet VPC endpoints for S3, Bedrock, SageMaker, KMS, CloudWatch Logs Without endpoint, AWS API calls fail
Restrict endpoint access Endpoint policies + security groups Endpoint policy can limit resources
No public model endpoint SageMaker endpoint in VPC; PrivateLink; disable direct internet Need NAT/endpoint for dependencies
Control data flow SG inbound and outbound rules; NACLs Outbound is data exfiltration path
Notebook/training isolation Private subnets, no public IP, VPC endpoints Public notebooks are high risk

Gotcha: Removing internet from a subnet also removes the path to AWS APIs. Replace it with VPC endpoints or managed egress, or the job fails.

Data & Artifact Protection

  • Encryption at rest: KMS CMK for S3, EBS, SageMaker artifacts, logs. Key policies are access control.
  • Encryption in transit: TLS for model invocation, S3, endpoints.
  • S3: Block Public Access, bucket policies, VPC endpoint policies, Macie for sensitive data.
  • Model artifacts: Restrict S3 access, use Model Registry approvals, validate checksums, scan external models.
  • Logs: Model invocation input/output may contain sensitive data; protect with KMS and strict access.

Pipeline & Supply Chain Security

Tool Scope Finds Gate?
CodeGuru Security Source code Insecure patterns, hardcoded credentials Yes
Inspector EC2, ECR images, Lambda CVEs, unintended network exposure Yes
Macie S3 Sensitive data/PII Yes
Config Resource config Drift, noncompliance Yes

Gotcha: Static code analysis and image scanning answer different questions. A clean code scan does not cover vulnerable OS/packages in the built image.

Runtime Safeguards & Responsible AI

Guardrail policy Applies to Use case
Content filters Input/output Harmful content categories
Denied topics Input/output Refuse specific subjects
Word filters Input/output Block exact terms/profanity
Sensitive information filters Input/output PII, regex, mask/block
Contextual grounding Output RAG answer supported by retrieved source
Automated Reasoning Output Statement consistent with formal rules

Gotcha: Guardrails filter content. They do not replace IAM, VPC, or endpoint access controls.

Auditing, Monitoring, Compliance

Record Service Answers Key config
API activity CloudTrail Who did what, when, from where Management events default; data events separate
Config history AWS Config What resource looked like; drift Rules, conformance packs
Invocation I/O CloudWatch Logs / model invocation logging What went in/out Protect logs with KMS/access controls
Metrics/alarms CloudWatch Anomalies, blocks, throttling Alarm on Guardrails blocks, 4xx/5xx, InvokeEndpoint

Gotcha: Model invocation calls (Bedrock InvokeModel, SageMaker InvokeEndpoint) are data events. A trail without data events will not show them.

Troubleshooting Security Issues

  • AccessDenied: Read the action/resource. Check IAM policy, SCP, permission boundary, bucket policy, KMS key policy, VPC endpoint policy. Grant the specific action on the specific resource.
  • Timeout from private subnet: Check route table, VPC endpoint, security group outbound, NACL.
  • No invocation in CloudTrail: Enable data events on the trail.
  • Guardrail not blocking: Verify policy config, version, and that it is applied to the model/agent; check input vs output.
  • Image scan findings: Update base image/dependencies, rebuild, rescan.

When to Use X vs Y

Choice Use when Not for
CloudTrail vs Config CloudTrail = who did what; Config = resource config/drift CloudTrail does not enforce config; Config does not log API calls
IAM role vs API key Role = production; API key = exploration/dev API key not for production
VPC endpoint vs NAT Endpoint = private AWS service access; NAT = internet egress Endpoint does not provide general internet
Guardrails vs IAM Guardrails = content policy; IAM = access control Guardrails cannot grant/deny model invocation
Inspector vs CodeGuru Inspector = images/deps/CVEs; CodeGuru = source code Neither replaces the other
Contextual grounding vs Automated Reasoning Grounding = RAG source support; Automated Reasoning = formal rules Different checks
Sensitive info filter vs word filter Sensitive info = PII/regex; word filter = exact terms Word filter cannot detect PII patterns
SG vs NACL SG = stateful, instance/ENI; NACL = stateless, subnet NACL for broad subnet rules

Anti-Patterns

  • Hardcoding secrets in code, images, or environment files.
  • Public S3 buckets for training data or model artifacts.
  • Over-permissive IAM roles (S3FullAccess, BedrockFullAccess).
  • Public SageMaker notebooks/endpoints.
  • No CloudTrail data events for model invocation.
  • Skipping image scanning because code scanning passed.
  • Using long-term API keys for production FM access.
  • Masking PII in responses but logging raw prompts/responses.
  • Trusting external model artifacts without validation.
  • Treating VPC isolation as content safety.

Hard rules: Least privilege, defense in depth, encrypt at rest and in transit, audit management + data events, use temporary credentials in production, and apply safeguards to both input and output.