AIF-C01
Deep Dive
The same principle that governs security in the cloud in general applies to AI services — but with an extra layer: prompts, generated content, and the base model itself introduce new lines of responsibility that don't exist in traditional compute or storage.
Contents
AWS is responsible for the AI compute infrastructure, and for the security and availability of the base foundation model. The customer is responsible for their prompts and the data they send to the model, for access control (IAM) to the AI services, and for regulatory compliance of their specific use case.
The difference from the "classic" IaaS/PaaS/SaaS model is that in AI there's a new object to protect: the prompt (what you send the model) and the generated response. Neither existed as a security concept in traditional compute.
Why this matters on the exam
A frequent AIF-C01 question presents a data-leak scenario or inappropriate content generated by a model, and asks you to identify whether the failure is AWS's or the customer's. The correct answer is almost always "the customer" — because AWS doesn't control what you send the model or how you configure access.
Who is responsible for each layer when you use AI services on AWS.
| Layer | Responsible |
|---|---|
| Physical infrastructure (GPUs, servers, datacenters) | AWS |
| Weights and security of the base foundation model | AWS |
| Service availability (SLA) | AWS |
| Tenant isolation (your data doesn't train other customers' models) | AWS |
| Prompts you send to the model | Customer |
| Data used for fine-tuning or RAG | Customer |
| Access control (IAM) to the AI services | Customer |
| Guardrails configuration / content filters | Customer |
| Regulatory compliance of the use case (HIPAA, GDPR, PCI DSS) | Customer |
| Auditing who invokes which model (CloudTrail enabled) | Customer |
| Encryption of training data and model artifacts | Shared |
| Bias detection in the model trained by the customer | Customer |
Regardless of whether you use Bedrock (managed model) or SageMaker (your own model), these responsibilities don't change.
AWS is ALWAYS responsible for:
The customer is ALWAYS responsible for:
Bedrock gives you access to already-trained foundation models via API. It's the "SaaS" equivalent in the AI world: AWS manages most of the stack.
AWS manages:
You manage:
With SageMaker you train and deploy your own model. It's more like "IaaS": you have more control, and therefore more responsibility.
AWS manages:
You manage:
Realistic case
A fintech builds an internal assistant with Bedrock so support agents can summarize a customer's history before a call. To save time, a developer pastes the customer's full account number, ID, and transaction history directly into the prompt — without masking any data — and doesn't configure Bedrock Guardrails to filter sensitive information in the responses.
Weeks later, an application log (poorly protected, with overly broad access due to an over-permissive IAM role) gets exposed. That log contains the full prompts, including the unmasked financial data.
Who is responsible? The customer, at every point in the chain: they decided what to include in the prompt, didn't configure Guardrails to mask PII, and configured an IAM role with excessive permissions over the logs. AWS delivered a functional model and secure infrastructure — none of those three decisions were under its control.
By default, calls to the Bedrock API or a SageMaker endpoint can go out over the public internet (although encrypted with TLS). AWS PrivateLink lets you expose those services through a private interface endpoint inside your VPC, so that traffic between your application and the AI service never leaves the internet.
Compare the public route to Bedrock against a private route via PrivateLink and confirm the private configuration.
+1 more...
When an AI agent acts autonomously (calling APIs, executing actions, invoking other tools), you need to manage identity and specific permissions for that agent — not just for the human user who invoked it.
Besides prompt injection on the input, there are risks that appear in the model's output and that must be filtered before showing it to the end user.
Bedrock Guardrails includes configurable toxicity filters as part of its content-moderation function.
Documenting where the data used to train or give context to a model comes from (data lineage) is key for traceability and auditing — especially when you have to answer "why did the model say this?" or "which document did this response come from?".
Beyond RAG in general, there are concrete techniques to reduce and detect hallucinations before they reach the user.
You can inherit AWS certifications for the infrastructure, but compliance for your specific use case is still yours — especially if you process regulated data.
What AWS certifies (infrastructure)
What you still need to do
Did you get this topic?
Test what you just learned
A company uses Amazon Bedrock for an internal chatbot. An employee includes a customer's confidential medical information directly in a prompt, without masking it, and that information ends up exposed in logs with overly open IAM permissions. Under the shared responsibility model, who is responsible for this breach?
Put what you learned to the test with original AIF-C01 exam questions.
Start AIF-C01 mock examUnlimited mock exams with the Pro plan
Log in to track your progress.