AWS wellarchitected documentation change
Summary
Added guidance for environment isolation specific to generative AI workloads, including model artifacts, prompt catalogs, AI endpoints, and data isolation for training/inference
Security assessment
The change extends existing environment isolation recommendations to cover AI-specific components but doesn't reference any specific vulnerability or incident. It proactively documents security best practices for new technology without evidence of addressing an exploit.
Diff
diff --git a/wellarchitected/latest/financial-services-industry-lens/fsisec08.md b/wellarchitected/latest/financial-services-industry-lens/fsisec08.md index 6b6d2a805..f9461bfe8 100644 --- a//wellarchitected/latest/financial-services-industry-lens/fsisec08.md +++ b//wellarchitected/latest/financial-services-industry-lens/fsisec08.md @@ -9 +9 @@ FSISEC08-BP01 Implement a multi-account strategyFSISEC08-BP02 Enforce network is -We recommend that you separate production workloads from non-production workloads. Maintaining resource isolation between software development lifecycle (SDLC) environments reduces the chance of misuse and accidents in production environments. This is an important guidance for all financial institutions, including those that are subject to Payment Card Industry Data Security Standard (PCI DSS). +We recommend that you separate production workloads from non-production workloads. Maintaining resource isolation between software development lifecycle (SDLC) environments reduces the chance of misuse and accidents in production environments. This is an important guidance for all financial institutions, including those that are subject to Payment Card Industry Data Security Standard (PCI DSS). For generative AI workloads, environment isolation extends to model artifacts, prompt catalogs, AI service endpoints, and data isolation for training datasets and inference data. @@ -16,0 +17,2 @@ We recommend that you isolate production workload environments and data in produ +For AI systems, establish clear separation between development and production environments while isolating model training and inference environments, maintaining separate prompt catalogs for each environment, and implementing strict controls for cross-environment AI service access. +