4.4 Encryption, PrivateLink, IAM Policies, and Audit Logging

🎯 Key AWS AI Exam Takeaways

• Encrypt data at rest using AWS KMS Customer Managed Keys (CMKs) and in transit using TLS 1.3.
• AWS PrivateLink Interface VPC Endpoints ensure Bedrock traffic never traverses the public internet.
• AWS CloudTrail audits all API calls; Amazon CloudWatch monitors invocation latency and token consumption.

Securing enterprise generative AI architectures requires layered defense-in-depth controls. Data at rest (in S3 buckets, Knowledge Base vector stores, and custom model weights) is encrypted using AWS Key Management Service (AWS KMS) with Customer Managed Keys (CMKs), while API traffic in transit is secured with TLS 1.3.

To eliminate internet exposure, organizations deploy Interface VPC Endpoints powered by AWS PrivateLink. This creates private Elastic Network Interfaces within private VPC subnets, routing all API requests to Amazon Bedrock entirely across the private AWS network backbone.

Access is strictly governed using IAM policies following the principle of least privilege, restricting `bedrock:InvokeModel` actions to explicit model Amazon Resource Names (ARNs). All control-plane and data-plane API activities are immutably recorded in AWS CloudTrail for compliance auditing, while Amazon CloudWatch tracks operational metrics such as InvocationLatency, Invocations, and InputTokenCount.

⚠️ Common Pearson VUE Exam Traps

• Never grant 'bedrock:*' with wildcard resources in production; restrict 'bedrock:InvokeModel' to specific model ARNs.
• Prompt Injection can be direct (jailbreaks) or indirect (poisoned web content/documents ingested by RAG).