Securing AI workloads on AWS
Bedrock, agents and the controls that apply when your application's behaviour is probabilistic.
AI workloads bring one genuinely new problem into an AWS account: the thing you're securing doesn't behave deterministically. Start with the Agentic AI Security Scoping Matrix, which right-sizes controls to how much autonomy you've actually granted an agent, viewed through a CPS 234 lens. AgentCore Identity is the least-privilege model for the new kind of identity an agent becomes the moment it can call tools — one that can be talked into acting, because its instructions arrive as natural language.
The other two lessons take a Bedrock application apart. Prompt injection is the threat class with no pre-AI analogue — you can't fully prevent it, only contain the blast radius — and securing a Bedrock app end to end is the fuller picture: mostly the IAM, network and logging you already do, plus that one new threat layered on top.
Lessons
- The Agentic AI Security Scoping Matrix, Explained (with the CPS 234 Lens)How much security does an AI agent need? It depends entirely on how much it can do on its own. AWS's new Agentic AI Security Scoping Matrix gives you the structure — here's how it works, and what it means for a regulated environment.
- Least-Privilege for AI Agents with AgentCore IdentityAn AI agent that can call tools is a new kind of identity in your AWS account — one that can be talked into doing things. AgentCore Identity is how you bound what a hijacked agent can reach.
- Prompt Injection on AWS Bedrock: How It Happens and How to Contain ItPrompt injection is the one genuinely new threat in a Bedrock app — and you can't fully prevent it. Here's how direct and indirect injection actually work, and the AWS controls that limit the damage.
- Securing a Bedrock App End-to-EndSecuring a generative-AI app on AWS Bedrock is mostly the security you already know — IAM, network, logging — plus one genuinely new threat class: prompt injection. Here's the full picture.
Common questions
- Does threat modelling change for an AI agent?
- Yes. Probabilistic output, memory poisoning and tool abuse are failure modes a conventional model does not cover.