Skip to content

Skill 4.3.8: Select the appropriate credential type to access FMs (e.g., Amazon Bedrock API keys, IAM credentials)

Task 4.3: Operating, Monitoring, and Securing ML and AI Solutions – Secure ML and AI workloads and model endpoints

Core Concept & Objective

  • Goal: Grant least-privilege access to foundation models (FMs) with strong auditability, no long-lived secrets, and production-grade rotation.
  • Primary services: IAM, STS, Amazon Bedrock API keys, Secrets Manager, KMS, VPC/PrivateLink, CloudTrail, AWS Config, Bedrock Guardrails.
  • Hard rule: Production workloads use IAM roles with temporary credentials. Bedrock API keys and IAM user access keys are for development, exploration, or legacy only.

Credential Type Decision Matrix

Credential Type Best For Lifetime Rotation Exam Notes / Traps
IAM role (temporary STS) Production apps on AWS: EC2, ECS, Lambda, SageMaker, EKS Minutes–hours Automatic Preferred for production. No secrets in code. Least privilege.
IAM Identity Center (SSO) Human workforce access Temporary Automatic For humans, not workloads. Use permission sets.
Short-term Bedrock API key Console/exploration, quick test Max 12 hours Expires Inherits permissions of generating IAM principal. Not for production.
Long-term Bedrock API key Development, non-prod Up to 90 days Manual/expiry Not for production. Tied to an IAM identity.
IAM user access keys Legacy/on-prem where roles impossible Long-term Manual Anti-pattern. Store in Secrets Manager and rotate if unavoidable.
Secrets Manager Storing/rotating static secrets (third-party FM API keys, DB creds) Managed Automatic Not a credential type itself. For secrets that must exist.
KMS Encrypting secrets, model artifacts, logs N/A N/A Not for authentication. CMK for compliance.

IAM Roles & Policies for FM Access

  • Least-privilege actions: bedrock:InvokeModel, bedrock:InvokeModelWithResponseStream, bedrock:Converse, bedrock:ConverseStream, bedrock:ListFoundationModels, bedrock:GetFoundationModel.
  • Resource scoping: Restrict to specific foundation-model ARNs, inference profiles, and guardrails. Avoid bedrock:* and * resources.
  • Condition keys: aws:SourceVpce to require VPC endpoint; aws:PrincipalArn; aws:SourceArn; bedrock:GuardrailIdentifier; aws:RequestedRegion.
  • Service roles: Bedrock assumes a role to access S3/KMS for custom models, batch inference, and knowledge bases. Trust policy must allow bedrock.amazonaws.com.
  • Cross-account: Use sts:AssumeRole with external ID. Avoid sharing long-term keys.
  • Permission boundaries & SCPs: Set maximum permissions. Use IAM Access Analyzer to find unused or over-permissive permissions.

Bedrock API Keys: Short-Term vs Long-Term

Attribute Short-Term API Key Long-Term API Key
Generation Bedrock console IAM identity / console
Lifetime ≤ 12 hours ≤ 90 days
Identity Inherits generating IAM principal Associated IAM identity
Use case Exploration, testing Development, non-prod
Production No No
Rotation Automatic expiry Manual or expiry
Scope Bedrock only Bedrock only

Network, Encryption & Compliance

  • VPC endpoint (PrivateLink): Interface endpoint for Bedrock. Keeps traffic off the internet. Combine with IAM condition aws:SourceVpce.
  • Security groups: Stateful. Restrict inbound and outbound. Outbound rules matter for data exfiltration.
  • KMS: Encrypt custom model data, batch inference input/output, CloudTrail logs, Secrets Manager secrets. Use customer-managed keys (CMK) for compliance.
  • TLS: All Bedrock API calls use HTTPS. No plaintext.
  • Guardrails: Apply content filters, denied topics, word filters, sensitive information filters, contextual grounding, and Automated Reasoning checks. Not a credential control.

Auditing & Monitoring: Which Service Answers What

Question Service Key Detail
Who called which API, when, from where? AWS CloudTrail Management events by default. Data events must be enabled for InvokeModel, Converse, etc.
What did the resource configuration look like over time? AWS Config Records configuration changes and evaluates against rules. Detects drift.
Are there software vulnerabilities in EC2/ECR/Lambda? Amazon Inspector Scans for CVEs and unintended network exposure.
Are there insecure patterns or hardcoded credentials in code? Amazon CodeGuru Security Static analysis.
How do I store/rotate a static secret? AWS Secrets Manager Stores and rotates secrets. Not for API auditing.

When to Use X vs Y (Trade-offs & Traps)

  • Bedrock API key vs IAM credentials:
  • API key: Simpler, no SigV4, but limited to Bedrock, inherits permissions, and expires. Use for dev/exploration.
  • IAM credentials: Full AWS auth, fine-grained, auditable, works with all AWS services. Use for production.
  • Short-term vs long-term Bedrock API key:
  • Short-term: ≤12h, inherits caller, ideal for console/test.
  • Long-term: ≤90 days, for dev, not prod.
  • IAM role vs IAM user:
  • Role: Temporary, auto-rotate, no secrets. Preferred.
  • User: Long-term keys, manual rotation. Only when roles impossible.
  • Secrets Manager vs KMS:
  • Secrets Manager: Store/rotate secrets.
  • KMS: Encrypt data/secrets at rest.
  • CloudTrail vs Config vs Inspector:
  • CloudTrail: API activity/audit.
  • Config: Configuration compliance/drift.
  • Inspector: Vulnerability scanning.
  • VPC endpoint vs Guardrails:
  • VPC endpoint: Network path isolation.
  • Guardrails: Content policy on prompts/responses. Neither replaces IAM.

Anti-Patterns & Exam Gotchas

Production must use IAM roles with temporary credentials. Long-term API keys and IAM user access keys are for dev/legacy only.

Bedrock short-term API keys expire within 12 hours and inherit the generating IAM principal's permissions. They are not a separate identity.

CloudTrail data events are off by default. Model invocation calls (InvokeModel, Converse) are data events and require explicit configuration.

Never hardcode credentials in code, container images, or environment files. Use Secrets Manager or IAM roles.

Over-permissive bedrock:* policies are a common trap. Scope to specific model ARNs and actions.

VPC endpoints do not inspect content. Use Guardrails for sensitive data and harmful content.

KMS is for encryption, not authentication. It does not grant FM access.

IAM policies can require VPC endpoint via aws:SourceVpce. This prevents calls from outside the VPC.

Quick Reference: Production vs Dev Credentials

Environment Recommended Credential Why
Production on AWS IAM role (temporary STS) Auto-rotation, least privilege, auditability
Production outside AWS IAM Roles Anywhere or OIDC + IAM role Avoid long-term keys
Development / exploration Short-term Bedrock API key Simple, expires quickly
Non-prod development Long-term Bedrock API key Longer expiry, still not prod
Legacy / unavoidable static secret Secrets Manager + rotation Secure storage and rotation
Human access IAM Identity Center (SSO) Temporary, centralized, auditable