4.3 AWS Shared Responsibility Model and Bedrock Data Privacy
Details customer vs. AWS responsibilities for AI services and examines AWS's explicit contractual data privacy commitments in Bedrock.
Key AWS AI Exam Takeaways
- AWS manages Security OF the Cloud (infrastructure, hardware, base model isolation).
- Customer manages Security IN the Cloud (data classification, IAM policies, guardrail rules, output validation).
- Bedrock Promise: Customer prompts and completions are NEVER used to train base foundation models and NEVER shared with model providers.
The AWS Shared Responsibility Model applies directly to AI and machine learning workloads. AWS is responsible for security 'OF' the cloud, encompassing physical data center security, hardware maintenance, network virtualization, and secure multi-tenant isolation of foundation models.
The customer remains strictly responsible for security 'IN' the cloud. This includes configuring appropriate IAM access policies, managing encryption keys, classifying data, configuring safety guardrails, monitoring token usage, and validating that model outputs are safe and accurate prior to operational use.
A critical concern for enterprise adoption is data privacy. AWS provides an explicit contractual guarantee for Amazon Bedrock: customer prompts, model responses, and customized models are private to the customer's AWS account. AWS does not use customer data to train the underlying base foundation models from Amazon or third-party providers (Anthropic, Meta, Mistral), and data is never transferred to model vendors.
A defense contractor wants to use Amazon Bedrock to summarize confidential proprietary technical specifications. Legal counsel is concerned that sensitive engineering data in customer prompts will be absorbed into public foundation models and leaked to competitors. What is AWS's explicit contractual data privacy commitment regarding Amazon Bedrock?