AWS wellarchitected high security documentation change
Summary
Added AI-specific vulnerability scanning in CI/CD pipelines and automated response validation for generative AI systems using AWS Lambda, Step Functions, and Amazon Bedrock Guardrails.
Security assessment
The change documents security measures against AI-specific threats like prompt injection and model manipulation. Concrete evidence includes 'Integrate AI-specific vulnerability scanning' and 'Amazon Bedrock Guardrails with built-in content filters, prompt injection detection', showing direct security countermeasures.
Diff
diff --git a/wellarchitected/latest/financial-services-industry-lens/fsisec06.md b/wellarchitected/latest/financial-services-industry-lens/fsisec06.md index 8a157d240..5ad907a3b 100644 --- a//wellarchitected/latest/financial-services-industry-lens/fsisec06.md +++ b//wellarchitected/latest/financial-services-industry-lens/fsisec06.md @@ -9 +9,3 @@ FSISEC06-BP01 Automate remediation of common vulnerabilities and exposures (CVEs -Security-focused enterprises are improving threat identification and remediation with DevSecOps. This approach accelerates application development and identifies threats early, and security testing is performed at each step of the software development lifecycle. Applying a DevSecOps framework is critical for an FI's software development, meeting the needs of a rapidly-changing product and a highly- regulated environment. +Security-focused enterprises are improving threat identification and remediation with DevSecOps. This approach accelerates application development and identifies threats early, and security testing is performed at each step of the software development lifecycle. Applying a DevSecOps framework is critical for an FI's software development, meeting the needs of a rapidly-changing product and a highly regulated environment. + +Emerging threats now include AI-specific concerns such as prompt injection, model manipulation, harmful model responses, and excessive agency risks from autonomous AI systems. Integrate AI-specific vulnerability scanning into CI/CD pipelines. @@ -14,0 +17,2 @@ Scanning servers for common vulnerabilities is a long-standing best practice. Ho +For generative AI systems, implement automated response validation through multiple complementary patterns with custom code validation using AWS Lambda with input and output validation logic and AWS Step Functions for orchestrated validation workflows. Consider LLM-as-a-judge where a specialized model (like Amazon Nova Premier) evaluates primary responses for safety and accuracy. Use Amazon Bedrock Guardrails with built-in content filters, prompt injection detection, and contextual grounding checks that can be applied at both input and output stages. +