AWS wellarchitected medium security documentation change
Summary
Added guidance for generative AI testing environments including cost-capped provisioning, guardrails for token quotas/model limits, IAM/SCP segregation, and automated cleanup of resources
Security assessment
Introduces security controls (IAM roles, SCPs) to prevent cross-account spend leakage and unauthorized access. Mandates automated cleanup to eliminate residual security risks from abandoned resources. Directly addresses security through access segregation and resource lifecycle management.
Diff
diff --git a/wellarchitected/latest/financial-services-industry-lens/fsicost13.md b/wellarchitected/latest/financial-services-industry-lens/fsicost13.md index 3aad89d72..78769834f 100644 --- a//wellarchitected/latest/financial-services-industry-lens/fsicost13.md +++ b//wellarchitected/latest/financial-services-industry-lens/fsicost13.md @@ -14,0 +15,6 @@ Some financial services institutions hire contractors during specific months, or +**Testing and consulting environments** Extend this principle to generative AI experimentation by provisioning temporary, cost-capped environments for proof of concept or consulting engagements. Use ephemeral inference endpoints (for example, Amazon Bedrock provisioned throughput with automatic teardown) and time-bounded SageMaker AI Studio domains for data scientists and contractors. + +Establish guardrails that enforce token quotas, model tier limits, and usage budgets per project, keeping generative AI testing compliant and cost-efficient. For partner or consulting access, apply fine-grained IAM roles and service control policies (SCPs) to segregate environments and avoid cross-account spend leakage. + +Automate cleanup of idle notebooks, vector stores, and test embeddings using AWS Lambda or Amazon EventBridge rules, verifying that sandbox environments incur zero residual cost post-engagement. +