Deep dive into Amazon Bedrock security architecture
summary
Amazon Bedrock hosts vendor model weights inside AWS, encrypts with Amazon KMS and TLS 1.2, and enforces IAM, CloudWatch and CloudTrail logging and VPC PrivateLink so nothing leaves the AWS region. Fine tuning runs as a SageMaker job that reads customer S3, places an ENI inside your VPC, writes tuned artifacts to a model account and never writes back to customer buckets. Two compute modes exist: on‑demand and provisioned. New guardrails check prompts and responses with denied topics, content filters and 34 PII entities (mask or block) plus regex and profanity filters.
AI-written summary · about
chapters (11)
- 0:00Introduction to Bedrock
- 0:34Bedrock service overview
- 1:07Models and providers
- 2:40Core security principles
- 6:25Access control management
- 7:22Model deployment options
- 8:54Networking and VPC
- 10:03Backend infrastructure
- 13:31Prompt security challenges
- 15:10Guardrails for Bedrock
- 19:44Conclusion and resources
related talks
55mSecurely build generative AI apps & control data with Amazon Bedrock
20mData is Your Differentiator: Building Secure and Tailored AI Systems
20mResponsible AI with Amazon Bedrock Guardrails
41mBuild AI applications with Guardrails for Amazon Bedrock
28mAWS security at scale
22mObservability in AI-Powered Applications with Amazon Bedrock
40mBuilding an AWS solutions architect agent with Amazon Bedrock
31mLamRAG: From Data to Constructive Insights using Amazon Bedrock