AWS wellarchitected medium security documentation change
Summary
Added guidance for monitoring generative AI systems and implementing IAM policies for AI services, including least privilege access, network controls, and permissions boundaries.
Security assessment
The change explicitly addresses security controls for generative AI systems by extending IAM monitoring to cover model access and prompt engineering, and mandates least privilege policies for AI endpoints. This directly mitigates privilege escalation risks in emerging AI workloads.
Diff
diff --git a/wellarchitected/latest/financial-services-industry-lens/fsisec03.md b/wellarchitected/latest/financial-services-industry-lens/fsisec03.md index 2cb6bbe2d..249bb4df2 100644 --- a//wellarchitected/latest/financial-services-industry-lens/fsisec03.md +++ b//wellarchitected/latest/financial-services-industry-lens/fsisec03.md @@ -9 +9 @@ FSISEC03-BP01 Review IAM policies and permissionsFSISEC03-BP02 Mitigate privileg -IAM policies are powerful and complex, so it's important to study and understand the permissions that are granted by each policy. Mitigate privilege escalation and monitor unauthorized activity in your AWS accounts. +IAM policies are powerful and complex, so it's important to study and understand the permissions that are granted by each policy. Mitigate privilege escalation and monitor unauthorized activity in your AWS accounts. With the introduction of generative AI systems, monitoring elevated credentials extends to model access, prompt engineering, and AI service management. @@ -15 +15,3 @@ IAM policies are powerful and complex, so it's important to study and understand -As part of the tight controls FIs implement around identity management and broader identity management policies, it is important to perform periodic reviews of your IAM roles using [last accessed](https://docs.aws.amazon.com/IAM/latest/UserGuide/access_policies_access-advisor-view-data.html) [information](https://docs.aws.amazon.com/IAM/latest/UserGuide/access_policies_access-advisor-view-data.html) to get a report about the last time that an IAM entity (user or role) attempted to access a service, and [delete roles that are not in use](https://docs.aws.amazon.com/IAM/latest/UserGuide/id_roles_manage_delete.html). Before you delete a role, review its recent service-level activity by viewing service last accessed data report. Use that information to refine your policies to allow access to only the services that are in use. Repeat this process to generate a report for each type of resource in IAM. +As part of the tight controls FIs implement around identity management and broader identity management policies, it is important to perform periodic reviews of your IAM roles using [last accessed information](https://docs.aws.amazon.com/IAM/latest/UserGuide/access_policies_access-advisor-view-data.html) to get a report about the last time that an IAM entity (user or role) attempted to access a service, and [delete roles that are not in use](https://docs.aws.amazon.com/IAM/latest/UserGuide/id_roles_manage_delete.html). Before you delete a role, review its recent service-level activity by viewing service last accessed data report. Use that information to refine your policies to allow access to only the services that are in use. Repeat this process to generate a report for each type of resource in IAM. + +For generative AI services, implement comprehensive IAM policies that grant least privilege access to foundation model endpoints while establishing private network communication, monitoring elevated credential usage in AI workflows, and implementing permissions boundaries for AI service roles including attribute-based access controls for dynamic AI resource management.