Amazon AIF-C01: AI Security & Privacy — Study Guide
Part of the AWS AI Practitioner AIF-C01 — Study Guide. Practice with verified answers in the Amazon exam hub, or take timed practice tests on ExamRoll.io.
Data protection and access control
Protecting training and inference data starts with least-privilege access. Use IAM roles for Amazon SageMaker, AWS Lambda, and Amazon Bedrock with fine-grained policies and resource-level restrictions; store credentials in AWS Secrets Manager and avoid embedding secrets in code. Classify data with Amazon Macie and AWS Glue Data Catalog so only approved datasets (and their approved subsets) enter training pipelines. For sensitive attributes, apply Comprehend PII detection and redaction or tokenization before storage or indexing; consider replacing PII with reversible tokens when linkage is required for downstream workflows. Enforce S3 bucket policies, block public access, and require SSE-KMS encryption for objects containing sensitive material. Use KMS key policies and key rotation to control who can decrypt training artefacts or model checkpoints. Common practitioner traps include granting broad SageMaker execution roles, forgetting to restrict S3 prefix access, and failing to rotate KMS keys or IAM credentials. Decision criteria should weigh the sensitivity of data, ability to redact or synthesize inputs, and whether direct model access to raw PII is strictly necessary. When PII must be preserved for model utility, prefer isolated processing with controlled audit trails rather than open storage.
Private connectivity, encryption, and key management
Network isolation and cryptographic controls are fundamental for production ML. Deploy SageMaker training and hosting inside VPCs using VPC endpoints and AWS PrivateLink so data never transits the public internet. Configure VPC interface endpoints for S3, Secrets Manager, and Bedrock (where supported) and apply endpoint policies to restrict traffic to approved principals and prefixes. Encrypt all data in transit with TLS and in rest with SSE-KMS (S3) and EBS encryption for training instances. Use AWS KMS for centralized key management; consider multi‑Region keys for disaster recovery and cross‑region operations, and restrict Decrypt permissions using KMS key policies. For highly regulated workloads, use AWS Nitro Enclaves to isolate cryptographic operations and attestation of model artifacts without exposing host memory. Common traps include forgetting to block S3 public access when using endpoint policies, leaving EC2 metadata overly permissive, or using customer KMS keys without explicit access controls. Choose client-side encryption if you must prevent AWS-side decryption, and prefer SSE-KMS when you need fine-grained access auditability plus integration with AWS services.
Logging, auditing, governance, and explainability
Maintain end‑to‑end observability: enable CloudTrail for API-level auditing across SageMaker, Bedrock, KMS, and S3; stream logs to CloudWatch and to a centralized, immutable archive for retention and compliance. Use AWS Config to record resource configurations and detect drift. For ML-specific lineage and governance, use SageMaker Model Registry and SageMaker Experiments to capture model metadata, versioning, provenance, and deployment history; integrate SageMaker Model Monitor to detect concept drift, data skew, and prediction quality degradation. For bias detection and explainability, instrument pipelines with SageMaker Clarify for dataset bias metrics, SHAP or integrated gradients for feature attribution, and produce model cards documenting training data, evaluation metrics, and known limitations. Practitioner traps include logging PII plaintext to CloudWatch, not correlating model versions to inference metrics, or lacking automated alerts on drift. Decision criteria should balance retention windows against cost, and require that explainability outputs are human‑readable and stored with model metadata for auditability and clinician/regulator review where applicable.
Privacy-preserving training, RAG, embeddings, and Bedrock security considerations
When models interact with sensitive corpora or serve user-specific content, apply privacy-preserving techniques. Differential privacy (DP) mechanisms during training can bound individual contribution; federated learning patterns can keep raw records on-premises while sharing model updates. For Retrieval-Augmented Generation, avoid indexing raw PII into vector stores; preprocess with PII redaction or store pointers and apply on-the-fly redaction at retrieval. Embeddings can leak sensitive information—treat vector stores like any database: encrypt at rest (S3/EBS), restrict access via IAM and VPC, and consider tokenizing keys or using query-time filters. Bedrock provides guardrails and moderation tooling to detect and block harmful inputs/outputs, and integrates with IAM and VPC controls; enforce guardrails as a defense-in-depth layer but do not rely on them as the sole control. Common traps include exposing the vector DB via open endpoints, failing to refresh RAG indexes causing stale or biased outputs, and assuming prompt tuning eliminates hallucinations. Choose between synchronous fine-tuning on Bedrock and runtime prompt engineering based on latency, data residency, and model governance needs.
Practical Problem: Use-Case Scenario
Scenario: Horizon Media, a streaming provider, runs a SageMaker-based AI pipeline plus Amazon Bedrock for assistant features. Viewership logs and personalization data reside in encrypted S3 buckets in eu‑west‑1 and daily content metadata is indexed into an OpenSearch vector store for RAG.
Challenge: They need to serve personalized recommendations and a Bedrock-backed conversational assistant while preventing PII leakage into embeddings, ensuring region-bound data processing, and providing auditable model lineage and drift alerts.
Recommended Approach:
- Configure SageMaker training and Bedrock access within a VPC using AWS PrivateLink and VPC interface endpoints; enforce S3 endpoint policies to restrict bucket prefixes.
- Use Amazon Macie and Comprehend PII to detect and redact PII before embedding; store only redacted text or reversible tokens in the vector store, encrypted with SSE-KMS.
- Register models and artifacts in SageMaker Model Registry and track experiments with SageMaker Experiments; enable Model Monitor for data and prediction drift and CloudTrail/CloudWatch for audit logs.
- Apply Bedrock guardrails for content moderation, enforce IAM and KMS key policies for region residency, and consider differential privacy or synthetic data for training on highly sensitive samples.
Rationale: Network isolation, centralized key control, PII redaction before embedding, and comprehensive lineage plus monitoring align with practitioner best practices to minimize leakage, meet data residency, and maintain auditable governance in production ML systems.
← Responsible AI · All domains · ML Data Engineering →
Practice these questions → · Timed practice on ExamRoll.io →
Pass the whole exam — not just this question
You found this answer. Get every verified question and explanation in one place, and save hours of prep. Free to start.
Pass your exam →