Amazon GuardDuty is properly enabled and monitoring for security threats in SageMaker workloads.

Amazon GuardDuty is not enabled, so threats to SageMaker workloads in this Region are not monitored.

Enable Amazon GuardDuty in this Region.

No roles with overly permissive AWS Agent Registry access found.

The following roles have AWS Agent Registry full-access policies: sample-registry-admin-role

Replace full-access policies with least-privilege AWS Agent Registry actions and scoped resources.

No roles with overly permissive AWS Agent Registry access found.

The following roles have wildcard or allow-except AWS Agent Registry permissions on all resources: sample-registry-admin-role

Replace wildcard permissions with required AWS Agent Registry actions and scoped resources.

Role 'sample-new-app-role' has overly permissive marketplace subscription access through policy 'AWSMarketplaceFullAccess'

Ensure that users have access to only the models that you want user to be able to subscribe to based on your organizational policies. For example, you may want users to have access to only text based models and not image and video generation model. This can also help to keep cost in check.

The following principals have AWS Agent Registry permissions but no service-last-accessed evidence: role 'AIMLSecurityMemberRole'

The following principals have AWS Agent Registry permissions they have not used: role 'sample-registry-role'

Review and remove unused AWS Agent Registry permissions following least privilege.

Role 'RescoAppStack-Ec2Role8DF2B528-BZ4vfVHs10Kw' has overly permissive marketplace subscription access through policy 'AWSElasticBeanstalkWebTier'

Ensure that users have access to only the models that you want user to be able to subscribe to based on your organizational policies. For example, you may want users to have access to only text based models and not image and video generation model. This can also help to keep cost in check.

Role 'aws-elasticbeanstalk-ec2-role' has overly permissive marketplace subscription access through policy 'AWSElasticBeanstalkMulticontainerDocker'

Ensure that users have access to only the models that you want user to be able to subscribe to based on your organizational policies. For example, you may want users to have access to only text based models and not image and video generation model. This can also help to keep cost in check.

Role 'xray-sample-SampleInstanceProfileRole-2YE24B4A5Y3RU' has overly permissive marketplace subscription access through policy 'AWSElasticBeanstalkWebTier'

Ensure that users have access to only the models that you want user to be able to subscribe to based on your organizational policies. For example, you may want users to have access to only text based models and not image and video generation model. This can also help to keep cost in check.

The Organizations Bedrock policy type is not enabled and no account-level enforced guardrail configuration was observed.

Enable Bedrock policies in AWS Organizations or configure account-level enforced guardrails.

Bedrock account data retention is inherit; this does not establish an explicit account-level zero-data-retention setting.

Set the account data-retention mode to none.

Bedrock account data retention is inherit; this does not establish an explicit account-level zero-data-retention setting.

Set the account data-retention mode to none.

GuardDuty is enabled, but the AI Protection detector feature is not enabled.

Enable the GuardDuty AI_PROTECTION detector feature for this region.

GuardDuty is enabled, but the AI Protection detector feature is not enabled.

Enable the GuardDuty AI_PROTECTION detector feature for this region.

No AgentCore online evaluation configurations found.

Configure online evaluation for production agent workloads where continuous assurance is required.

AgentCore token vault 'default' uses a service-managed or AWS-owned key.

Configure the AgentCore Identity token vault with a customer-managed KMS key.

No AgentCore online evaluation configurations found.

Online evaluation 'sample-agent-eval' (sample-agent-eval-0001) is missing one or more operational coverage settings.

Each run reported one Failed row for this check, so the two rows were paired, but their details differ. Check whether one resource was fixed and another started failing.

Set the evaluation ACTIVE and ENABLED, use non-zero sampling, add evaluators, and configure CloudWatch input and output log groups.

AgentCore token vault 'default' uses a service-managed or AWS-owned key.

Configure the AgentCore Identity token vault with a customer-managed KMS key.

No AgentCore online evaluation configurations found.

Configure online evaluation for production agent workloads where continuous assurance is required.

Agentic AI security domain: Guardrail Enforcement. Organization-level guardrail enforcement helps prevent agents from bypassing required safety controls across accounts. Source check BR-15: The Organizations Bedrock policy type is not enabled and no account-level enforced guardrail configuration was observed.

Use IAM and organization controls to require approved guardrails for model and agent invocations where supported.

Agentic AI security domain: Auditability & Continuous Assurance. Online evaluation provides continuous evidence about agent behavior, quality, and policy-relevant outcomes. Source check AC-17: No AgentCore online evaluation configurations found.

Configure an active AgentCore online evaluation with sampling, evaluators, CloudWatch input logs, and an output log group.

Agentic AI security domain: Agent Identity & Access. Agent credentials stored in the Identity token vault should use customer-controlled encryption where enhanced key control is required. Source check AC-14: AgentCore token vault 'default' uses a service-managed or AWS-owned key.

Configure the AgentCore Identity token vault with a customer-managed KMS key.

Agentic AI security domain: Auditability & Continuous Assurance. Online evaluation provides continuous evidence about agent behavior, quality, and policy-relevant outcomes. Source check AC-17: No AgentCore online evaluation configurations found.

Agentic AI security domain: Auditability & Continuous Assurance. Online evaluation provides continuous evidence about agent behavior, quality, and policy-relevant outcomes. Source check AC-17: Online evaluation 'sample-agent-eval' (sample-agent-eval-0001) is missing one or more operational coverage settings.

Each run reported one Failed row for this check, so the two rows were paired, but their details differ. Check whether one resource was fixed and another started failing.

Configure an active AgentCore online evaluation with sampling, evaluators, CloudWatch input logs, and an output log group.

Agentic AI security domain: Agent Identity & Access. Agent credentials stored in the Identity token vault should use customer-controlled encryption where enhanced key control is required. Source check AC-14: AgentCore token vault 'default' uses a service-managed or AWS-owned key.

Configure the AgentCore Identity token vault with a customer-managed KMS key.

Agentic AI security domain: Auditability & Continuous Assurance. Online evaluation provides continuous evidence about agent behavior, quality, and policy-relevant outcomes. Source check AC-17: No AgentCore online evaluation configurations found.

Configure an active AgentCore online evaluation with sampling, evaluators, CloudWatch input logs, and an output log group.

AWS Shield Advanced is not subscribed. GenAI API endpoints are vulnerable to volumetric DDoS attacks that can exhaust token quotas and inflate costs.

1. Subscribe to AWS Shield Advanced for DDoS protection. 2. After subscribing, explicitly add resource protections in the Shield Advanced console for each Bedrock-facing resource (API Gateway stages, ALBs, CloudFront distributions, Route 53 hosted zones). Shield Advanced subscription alone does NOT automatically protect resources — each resource must be individually added to receive protection. 3. Enable Shield Response Team (SRT) access and configure proactive engagement. 4. Alternatively, use AWS Firewall Manager with a Shield Advanced policy to automate resource protection based on tags or resource types.

No AWS WAF regional Web ACLs found. Without WAF, GenAI endpoints lack rate-based rules to block abusive callers.

1. Create a WAF Web ACL with rate-based rules (e.g., 1000 req/5 min per IP). 2. Associate the ACL with API Gateway stages or ALBs fronting Bedrock. 3. Add AWS Managed Rules for known bad inputs.

No AWS Cost Anomaly Detection monitors found. Unexpected spikes in Bedrock/SageMaker usage (e.g., from prompt injection loops) will go undetected.

1. Create a Cost Anomaly Detection monitor scoped to AWS/Bedrock and AWS/SageMaker. 2. Configure alert subscriptions (SNS/email) for anomalies above threshold. 3. Set daily spend budgets with AWS Budgets as a secondary control.

No CloudWatch alarms found for Bedrock metrics. Token exhaustion and throttling events will not trigger operational alerts.

Create CloudWatch alarms for: - AWS/Bedrock InvocationThrottles (threshold > 0) - AWS/Bedrock TokensProcessed (threshold based on quota) - Custom application-level token counters via EMF

No AWS Budgets found scoped to Bedrock or SageMaker. Unbounded GenAI spend can go undetected until the monthly bill.

1. Create cost budgets for AWS Bedrock and SageMaker with 80%/100% alert thresholds. 2. Add SNS notifications to on-call channels. 3. Consider budget actions to apply IAM deny policies when thresholds are breached.

Agent-related Lambda functions without reserved concurrency: aiml-security-aiml-sec-123456789012-AgentCoreAssessment, aiml-security-aiml-sec-123456789012-CleanupBucket, aiml-security-aiml-sec-123456789012-ResolveRegions, aiml-security-aiml-sec-123456789012-SagemakerAssessment, aiml-security-aiml-sec-123456789012-GenerateReport, aiml-security-aiml-sec-123456789012-AgentRegistryAssessment, aiml-security-aiml-sec-123456789012-RAIGRCAssessment, aiml-security-aiml-sec-123456789012-BedrockAssessment, AIML-Standalone-CodeBuildStartBuildLambda-eAzlGvTTrtQW, aiml-security-aiml-sec-123456789012-IAMPermissionCaching. Unlimited concurrency allows runaway agent loops to exhaust account limits.

1. Set reserved concurrency on agent Lambda functions. 2. Implement maximum iteration counts in agent orchestration logic. 3. Use Step Functions with MaxConcurrency and timeout states. 4. Add circuit-breaker patterns to agent tool invocations.

No CloudWatch alarms found for agent invocation rates. Looping or runaway agents will not trigger operational alerts.

Create CloudWatch alarms on: - Bedrock agent invocation counts (threshold based on expected max) - Lambda invocation errors for agent functions - Step Functions execution failures and timeouts

No Service Control Policies reference Bedrock. Without SCPs, any account in the organization can access any Bedrock model, including unapproved third-party models.

1. Create an SCP that denies bedrock:InvokeModel, bedrock:InvokeModelWithResponseStream, and bedrock:CreateModelInvocationJob outside approved model access. 2. Use Resource or NotResource with approved foundation-model, custom-model, provisioned-model, and inference-profile ARNs to express the allowlist. 3. Maintain a model inventory and update the SCP when models are approved/retired.

No Bedrock Model Evaluation jobs found. Models have not been evaluated for adversarial robustness. Model-risk management (SR 11-7) expects documented model validation/evaluation.

1. Run Bedrock Model Evaluation with adversarial/red-team datasets. 2. Use FMEval library for automated robustness testing. 3. Schedule periodic re-evaluation after model updates.

787 role(s) with wildcard KB permissions: - Role 'Admin' allows '*' - Role 'aiml-sec-123456789012-BedrockSecurityAssessmentFunc-sl8sQor1MSud' allows 'bedrock:ListGuardrails' on Resource '*' (no ARN scoping to specific Knowledge Bases) - Role 'aiml-sec-123456789012-BedrockSecurityAssessmentFunc-sl8sQor1MSud' allows 'bedrock:GetGuardrail' on Resource '*' (no ARN scoping to specific Knowledge Bases) - Role 'aiml-sec-123456789012-BedrockSecurityAssessmentFunc-sl8sQor1MSud' allows 'bedrock:GetModelInvocationLoggingConfiguration' on Resource '*' (no ARN scoping to specific Knowledge Bases) - Role 'aiml-sec-123456789012-BedrockSecurityAssessmentFunc-sl8sQor1MSud' allows 'bedrock:ListPrompts' on Resource '*' (no ARN scoping to specific Knowledge Bases) - Role 'aiml-sec-123456789012-BedrockSecurityAssessmentFunc-sl8sQor1MSud' allows 'bedrock:GetPrompt' on Resource '*' (no ARN scoping to specific Knowledge Bases) - Role 'aiml-sec-123456789012-BedrockSecurityAssessmentFunc-sl8sQor1MSud' allows 'bedrock:ListAgents' on Resource '*' (no ARN scoping to specific Knowledge Bases) - Role 'aiml-sec-123456789012-BedrockSecurityAssessmentFunc-sl8sQor1MSud' allows 'bedrock:GetAgent' on Resource '*' (no ARN scoping to specific Knowledge Bases) - Role 'aiml-sec-123456789012-BedrockSecurityAssessmentFunc-sl8sQor1MSud' allows 'bedrock:ListCustomModels' on Resource '*' (no ARN scoping to specific Knowledge Bases) - Role 'aiml-sec-123456789012-BedrockSecurityAssessmentFunc-sl8sQor1MSud' allows 'bedrock:GetCustomModel' on Resource '*' (no ARN scoping to specific Knowledge Bases)

Replace wildcard bedrock:* with specific actions such as bedrock:Retrieve, bedrock:RetrieveAndGenerate. Scope resources to specific Knowledge Base ARNs.

No OpenSearch Serverless network policies found. Vector store collections may be publicly accessible.

Create network security policies for OpenSearch Serverless collections restricting access to VPC endpoints only.

No Bedrock Automated Reasoning policies have been created. ARC (GA August 2025) uses formal verification to guarantee that GenAI outputs comply with authored business rules — e.g., loan criteria, regulatory thresholds, policy constraints. Without ARC policies, factual accuracy of outputs is not formally verified, only heuristically filtered by contextual grounding thresholds.

1. In the Amazon Bedrock console → Guardrails → Automated Reasoning, create a policy document encoding your business rules (e.g., eligibility criteria, rate limits, regulatory thresholds). 2. Associate the ARC policy with your guardrail (automatedReasoningPolicy.policies field in CreateGuardrail/UpdateGuardrail). 3. Set confidenceThreshold on the policy to control strictness. 4. ARC requires cross-Region inference — ensure your guardrail has a guardrailProfileArn configured (crossRegionDetails in GetGuardrail response). 5. Reference: AWS Announcement — Automated Reasoning checks GA (August 2025).

No SageMaker Clarify model bias monitoring schedules found. Models making financial decisions (credit, insurance) may exhibit discriminatory bias without detection.

1. Configure SageMaker Clarify bias detection for all models making credit, insurance, or employment decisions. 2. Define protected attributes (age, gender, race proxies). 3. Set bias metric thresholds and alert on violations. 4. Document bias testing results for regulatory examination.

No SageMaker Clarify explainability monitoring found. Models making adverse financial decisions may not provide required explanations (ECOA adverse action notices).

1. Configure SageMaker Clarify explainability for credit/lending models. 2. Generate SHAP values for feature importance. 3. Map top features to human-readable adverse action reason codes. 4. Store explanations for regulatory examination.

Amazon Macie is enabled, but automated sensitive data discovery is DISABLED. Enabling Macie alone does not scan any data, so S3 buckets containing training data and KB data sources are not being evaluated for PII.

1. Enable automated sensitive data discovery in Macie. 2. Confirm the classification scope includes training data and KB source buckets. 3. Alternatively, create targeted classification jobs for those buckets.

No active Bedrock Knowledge Bases found. GenAI responses are not grounded in authoritative data sources, increasing hallucination risk.

1. Create Bedrock Knowledge Bases with authoritative financial data. 2. Use RetrieveAndGenerate API to ground responses. 3. Configure data sources with current regulatory and product information.

No guardrails have RELEVANCE contextual grounding filters. Without relevance filters, responses that are off-topic or unrelated to the user query will not be blocked, increasing hallucination risk in RAG-based applications.

Enable the RELEVANCE contextual grounding filter in Bedrock Guardrails with a threshold of ≥0.7 to block responses that are not relevant to the user query. Also enable the GROUNDING filter (≥0.7) to block responses not supported by the retrieved source context.

No Lambda functions with output validation/sanitization naming found. GenAI outputs may be passed directly to downstream systems without validation.

1. Implement output validation Lambda functions in GenAI pipelines. 2. Validate output schema, length, and content before downstream use. 3. Sanitize outputs before rendering in web UIs (XSS prevention). 4. Encode outputs appropriately for the target context (HTML, SQL, JSON).

Found 4 REST API(s) and 0 regional WAF Web ACL(s), but none enforce a maximum request-body size. Note: an API Gateway request validator does NOT cap body size (it validates the schema and required params; the REST limit is a fixed 10 MB), and a WAF body SizeConstraint only inspects the first ~16 KB of the body by default. Oversized prompts can exhaust Bedrock token quotas and inflate costs.

1. Add a maxLength (or maxItems/maxProperties) bound to the request-body JSON-Schema model used by your request validator, so oversized prompts are rejected with a 400. 2. Add a WAF SizeConstraintStatement on the request Body sized within WAF's body-inspection window (default 16 KB; raise via the web ACL AssociationConfig, or set OversizeHandling=MATCH to block bodies beyond the window), and associate the ACL with the API stage. 3. Set the max_tokens parameter in Bedrock API calls to cap output length. 4. Implement client-side token counting before submitting requests.

OWASP category: LLM02:2025 Sensitive Information Disclosure. Source check FS-44: Amazon Macie is enabled, but automated sensitive data discovery is DISABLED. Enabling Macie alone does not scan any data, so S3 buckets containing training data and KB data sources are not being evaluated for PII.

Enable Amazon Macie with automated discovery on S3 buckets that hold training or knowledge-base data.

OWASP category: LLM03:2025 Supply Chain. Source check FS-15: No Bedrock Model Evaluation jobs found. Models have not been evaluated for adversarial robustness. Model-risk management (SR 11-7) expects documented model validation/evaluation.

Run Bedrock evaluation jobs that include adversarial and safety datasets before promoting a model to production.

OWASP category: LLM03:2025 Supply Chain. Source check FS-12: No Service Control Policies reference Bedrock. Without SCPs, any account in the organization can access any Bedrock model, including unapproved third-party models.

Attach an Organizations SCP that denies Bedrock inference outside allowlisted model and inference-profile ARNs using Resource or NotResource scoping.

OWASP category: LLM05:2025 Improper Output Handling. Source check FS-55: No Lambda functions with output validation/sanitization naming found. GenAI outputs may be passed directly to downstream systems without validation.

Deploy an output-validation / sanitisation Lambda between the model response and any downstream consumer to filter injection payloads in generated output.

OWASP category: LLM06:2025 Excessive Agency. Source check FS-09: Agent-related Lambda functions without reserved concurrency: aiml-security-aiml-sec-123456789012-AgentCoreAssessment, aiml-security-aiml-sec-123456789012-CleanupBucket, aiml-security-aiml-sec-123456789012-ResolveRegions, aiml-security-aiml-sec-123456789012-SagemakerAssessment, aiml-security-aiml-sec-123456789012-GenerateReport, aiml-security-aiml-sec-123456789012-AgentRegistryAssessment, aiml-security-aiml-sec-123456789012-RAIGRCAssessment, aiml-security-aiml-sec-123456789012-BedrockAssessment, AIML-Standalone-CodeBuildStartBuildLambda-eAzlGvTTrtQW, aiml-security-aiml-sec-123456789012-IAMPermissionCaching. Unlimited concurrency allows runaway agent loops to exhaust account limits.

Set reserved concurrency on agent action-group Lambdas so a runaway agent cannot exhaust downstream capacity.

OWASP category: LLM08:2025 Vector and Embedding Weaknesses. Source check FS-22: 787 role(s) with wildcard KB permissions: - Role 'Admin' allows '*' - Role 'aiml-sec-123456789012-BedrockSecurityAssessmentFunc-sl8sQor1MSud' allows 'bedrock:ListGuardrails' on Resource '*' (no ARN scoping to specific Knowledge Bases) - Role 'aiml-sec-123456789012-BedrockSecurityAssessmentFunc-sl8sQor1MSud' allows 'bedrock:GetGuardrail' on Resource '*' (no ARN scoping to specific Knowledge Bases) - Role 'aiml-sec-123456789012-BedrockSecurityAssessmentFunc-sl8sQor1MSud' allows 'bedrock:GetModelInvocationLoggingConfiguration' on Resource '*' (no ARN scoping to specific Knowledge Bases) - Role 'aiml-sec-123456789012-BedrockSecurityAssessmentFunc-sl8sQor1MSud' allows 'bedrock:ListPrompts' on Resource '*' (no ARN scoping to specific Knowledge Bases) - Role 'aiml-sec-123456789012-BedrockSecurityAssessmentFunc-sl8sQor1MSud' allows 'bedrock:GetPrompt' on Resource '*' (no ARN scoping to specific Knowledge Bases) - Role 'aiml-sec-123456789012-BedrockSecurityAssessmentFunc-sl8sQor1MSud' allows 'bedrock:ListAgents' on Resource '*' (no ARN scoping to specific Knowledge Bases) - Role 'aiml-sec-123456789012-BedrockSecurityAssessmentFunc-sl8sQor1MSud' allows 'bedrock:GetAgent' on Resource '*' (no ARN scoping to specific Knowledge Bases) - Role 'aiml-sec-123456789012-BedrockSecurityAssessmentFunc-sl8sQor1MSud' allows 'bedrock:ListCustomModels' on Resource '*' (no ARN scoping to specific Knowledge Bases) - Role 'aiml-sec-123456789012-BedrockSecurityAssessmentFunc-sl8sQor1MSud' allows 'bedrock:GetCustomModel' on Resource '*' (no ARN scoping to specific Knowledge Bases)

Scope Knowledge Base IAM roles to specific KB ARNs; remove wildcard bedrock:* on KB actions.

OWASP category: LLM08:2025 Vector and Embedding Weaknesses. Source check FS-26: No OpenSearch Serverless network policies found. Vector store collections may be publicly accessible.

Set AllowFromPublic=false on the OpenSearch Serverless network policy and restrict access to bedrock.amazonaws.com or a specific VPC endpoint.

OWASP category: LLM09:2025 Misinformation. Source check FS-48: No active Bedrock Knowledge Bases found. GenAI responses are not grounded in authoritative data sources, increasing hallucination risk.

Deploy at least one ACTIVE Knowledge Base when Bedrock models are used, so grounded retrieval is available.

OWASP category: LLM10:2025 Unbounded Consumption. Source check FS-68: Found 4 REST API(s) and 0 regional WAF Web ACL(s), but none enforce a maximum request-body size. Note: an API Gateway request validator does NOT cap body size (it validates the schema and required params; the REST limit is a fixed 10 MB), and a WAF body SizeConstraint only inspects the first ~16 KB of the body by default. Oversized prompts can exhaust Bedrock token quotas and inflate costs.

Configure API Gateway request validation or an equivalent ingress control so GenAI endpoints reject oversized request bodies before they can drive excessive model consumption.

OWASP category: LLM10:2025 Unbounded Consumption. Source check FS-06: No AWS Budgets found scoped to Bedrock or SageMaker. Unbounded GenAI spend can go undetected until the monthly bill.

Configure AWS Budgets with FilterExpression / CostFilters targeting Bedrock or SageMaker spend, with an alerting SNS action.

OWASP category: LLM10:2025 Unbounded Consumption. Source check FS-04: No AWS Cost Anomaly Detection monitors found. Unexpected spikes in Bedrock/SageMaker usage (e.g., from prompt injection loops) will go undetected.

Configure AWS Cost Anomaly Detection monitors that include Bedrock and SageMaker.

OWASP category: LLM10:2025 Unbounded Consumption. Source check FS-05: No CloudWatch alarms found for Bedrock metrics. Token exhaustion and throttling events will not trigger operational alerts.

Create CloudWatch alarms on the Bedrock namespace for InvocationThrottles and token counters.

OWASP category: LLM10:2025 Unbounded Consumption. Source check FS-01: AWS Shield Advanced is not subscribed. GenAI API endpoints are vulnerable to volumetric DDoS attacks that can exhaust token quotas and inflate costs.

Add a WAF RateBasedStatement plus a SizeConstraintStatement on the GenAI ingress and subscribe to AWS Shield Advanced.

OWASP category: LLM10:2025 Unbounded Consumption. Source check FS-01: No AWS WAF regional Web ACLs found. Without WAF, GenAI endpoints lack rate-based rules to block abusive callers.

Add a WAF RateBasedStatement plus a SizeConstraintStatement on the GenAI ingress and subscribe to AWS Shield Advanced.

OWASP category: LLM01:2025 Prompt Injection. Source check SM-26: GuardDuty is enabled, but the AI Protection detector feature is not enabled.

Enable the GuardDuty AI_PROTECTION detector feature to detect supported direct prompt-injection activity.

OWASP category: LLM02:2025 Sensitive Information Disclosure. Source check BR-37: Bedrock account data retention is inherit; this does not establish an explicit account-level zero-data-retention setting.

Configure Bedrock account data retention as none and disable provider data sharing when prompts or responses may contain sensitive information.

OWASP category: LLM10:2025 Unbounded Consumption. Source check SM-26: GuardDuty is enabled, but the AI Protection detector feature is not enabled.

Enable the GuardDuty AI_PROTECTION detector feature to detect supported anomalous model invocation and cost-harvesting activity.

OWASP category: LLM02:2025 Sensitive Information Disclosure. Source check AC-14: AgentCore token vault 'default' uses a service-managed or AWS-owned key.

Configure the AgentCore Identity token vault with a customer-managed KMS key to protect stored credentials and tokens.

OWASP category: LLM02:2025 Sensitive Information Disclosure. Source check BR-37: Bedrock account data retention is inherit; this does not establish an explicit account-level zero-data-retention setting.

Configure Bedrock account data retention as none and disable provider data sharing when prompts or responses may contain sensitive information.

OWASP category: LLM01:2025 Prompt Injection. Source check SM-26: GuardDuty is enabled, but the AI Protection detector feature is not enabled.

Enable the GuardDuty AI_PROTECTION detector feature to detect supported direct prompt-injection activity.

OWASP category: LLM02:2025 Sensitive Information Disclosure. Source check AC-14: AgentCore token vault 'default' uses a service-managed or AWS-owned key.

Configure the AgentCore Identity token vault with a customer-managed KMS key to protect stored credentials and tokens.

OWASP category: LLM10:2025 Unbounded Consumption. Source check SM-26: GuardDuty is enabled, but the AI Protection detector feature is not enabled.

Enable the GuardDuty AI_PROTECTION detector feature to detect supported anomalous model invocation and cost-harvesting activity.

Service-linked role 'AWSServiceRoleForBedrockAgentCoreNetwork' does not exist. VPC configuration for AgentCore Runtimes will fail without this role.

Service-linked role 'AWSServiceRoleForBedrockAgentCoreNetwork' exists.

No action required

AgentCore token vault 'default' uses a service-managed or AWS-owned key.

AgentCore token vault 'default' uses a customer-managed KMS key.

No action required

Agentic AI security domain: Agent Identity & Access. Agent credentials stored in the Identity token vault should use customer-controlled encryption where enhanced key control is required. Source check AC-14: AgentCore token vault 'default' uses a service-managed or AWS-owned key.

Agentic AI security domain: Agent Identity & Access. Agent credentials stored in the Identity token vault should use customer-controlled encryption where enhanced key control is required. Source check AC-14: AgentCore token vault 'default' uses a customer-managed KMS key.

Configure the AgentCore Identity token vault with a customer-managed KMS key.

OWASP category: LLM02:2025 Sensitive Information Disclosure. Source check AC-14: AgentCore token vault 'default' uses a service-managed or AWS-owned key.

OWASP category: LLM02:2025 Sensitive Information Disclosure. Source check AC-14: AgentCore token vault 'default' uses a customer-managed KMS key.

Configure the AgentCore Identity token vault with a customer-managed KMS key to protect stored credentials and tokens.

Bedrock account data retention is inherit; this does not establish an explicit account-level zero-data-retention setting.

Set the account data-retention mode to none.

OWASP category: LLM02:2025 Sensitive Information Disclosure. Source check BR-37: Bedrock account data retention is inherit; this does not establish an explicit account-level zero-data-retention setting.

Configure Bedrock account data retention as none and disable provider data sharing when prompts or responses may contain sensitive information.

GuardDuty is enabled, but the AI Protection detector feature is not enabled.

GuardDuty AI Protection status could not be read: AccessDeniedException.

Grant guardduty:GetDetector and retry the assessment.

OWASP category: LLM01:2025 Prompt Injection. Source check SM-26: GuardDuty is enabled, but the AI Protection detector feature is not enabled.

OWASP category: LLM01:2025 Prompt Injection. Source check SM-26: GuardDuty AI Protection status could not be read: AccessDeniedException.

Enable the GuardDuty AI_PROTECTION detector feature to detect supported direct prompt-injection activity.

OWASP category: LLM10:2025 Unbounded Consumption. Source check SM-26: GuardDuty is enabled, but the AI Protection detector feature is not enabled.

OWASP category: LLM10:2025 Unbounded Consumption. Source check SM-26: GuardDuty AI Protection status could not be read: AccessDeniedException.

Enable the GuardDuty AI_PROTECTION detector feature to detect supported anomalous model invocation and cost-harvesting activity.

No roles found with AmazonBedrockFullAccess policy

No action required

No regional Bedrock resources found to assess private connectivity

No action required

No regional Bedrock resources found to monitor with invocation logging

No action required

No regional Bedrock resources found to protect with guardrails

No action required

No regional Bedrock resources found to audit with Bedrock-specific CloudTrail coverage

No action required

Prompt Management feature is not being used. This may lead to inconsistent prompt handling and suboptimal model responses.

Implement Prompt Management to: 1. Create and version your prompts 2. Test different prompt variants 3. Share prompts across your organization 4. Maintain consistent prompt templates

No Bedrock agents found in the account

No action required

No Knowledge Bases found in the account

No action required

No guardrails configured - IAM enforcement check not applicable

Configure Bedrock Guardrails first, then enforce their use via IAM policies

No custom/fine-tuned models found in the account

No action required

Model invocation logging to S3 is not configured

If logging is enabled to CloudWatch only, ensure CloudWatch log group uses CMK encryption

No Bedrock Flows found in the account

No action required

No Bedrock guardrails configured in this region

Create Bedrock guardrails with Standard tier for enhanced content filtering and protection

No custom (fine-tuned) Bedrock models found in this region

When creating custom models, specify a customer-managed KMS key for encryption to maintain control over encryption keys

No regional Bedrock resources found to assess with model evaluation jobs

No action required

No Bedrock prompt flows configured in this region

When creating prompt flows, use the ValidateFlowDefinition API to validate flow definitions before deployment

No Bedrock knowledge bases found in this region

When creating knowledge bases, specify customer-managed KMS keys for both vector store and data source encryption

No Bedrock agents configured in this region

When creating agents with action groups, ensure Lambda execution roles follow least privilege principles

No regional Bedrock resources found to assess model invocation throttling quotas

No action required

No Bedrock guardrails configured in this region

Create guardrails with all harmful-content filters enabled.

No Bedrock guardrails configured in this region

Create guardrails with Automated Reasoning policies for formal verification of model responses

No Bedrock knowledge bases found in this region

When implementing RAG applications, configure evaluation jobs to assess context relevance, response correctness, and prevent hallucinations

No Bedrock guardrails configured in this region

Create guardrails with sensitive-information filters (PII entities and/or regex patterns) to detect and redact sensitive data in prompts and model responses

No Bedrock guardrails configured in this region

Create guardrails with contextual grounding checks to detect hallucinations (ungrounded responses) and irrelevant answers, especially for RAG applications

No Bedrock agents configured in this region

When creating agents, associate a Bedrock guardrail so agent inputs and responses are filtered for harmful content, PII, and denied topics

No Bedrock agents configured in this region

When creating agents, set a conservative idleSessionTTLInSeconds to limit how long an idle session remains resumable

No imported custom Bedrock models found in this region

When importing models, specify a customer-managed KMS key for encryption to maintain control over encryption keys

No Bedrock batch inference (model invocation) jobs found in this region

When creating batch inference jobs, set outputDataConfig.s3OutputDataConfig.s3EncryptionKeyId to a customer-managed KMS key to encrypt the job output

No regional Bedrock resources found to monitor with CloudWatch alarms

No action required

Amazon Inspector Lambda standard scanning and Lambda code scanning are both ENABLED in us-east-1. Detected 1 Lambda function(s) with Bedrock indicators: aiml-security-aiml-sec-123456789012-BedrockAssessment.

No action required.

No Bedrock guardrails configured in this region

Create guardrails with a preventive PROMPT_ATTACK filter.

No Bedrock guardrails configured in this region

No action required

No application inference profiles found

No action required

No Automated Reasoning policies found

No action required

No Bedrock Marketplace model endpoints found

No action required

No Bedrock Marketplace model endpoints found

No action required

No regional Bedrock resources found to assess private connectivity

No action required

No regional Bedrock resources found to monitor with invocation logging

No action required

No regional Bedrock resources found to protect with guardrails

No action required

No regional Bedrock resources found to audit with Bedrock-specific CloudTrail coverage

No action required

Prompt Management feature is not being used. This may lead to inconsistent prompt handling and suboptimal model responses.

Implement Prompt Management to: 1. Create and version your prompts 2. Test different prompt variants 3. Share prompts across your organization 4. Maintain consistent prompt templates

No Bedrock agents found in the account

No action required

No Knowledge Bases found in the account

No action required

No guardrails configured - IAM enforcement check not applicable

Configure Bedrock Guardrails first, then enforce their use via IAM policies

Custom model API not available in us-east-2

Verify permissions to access Bedrock custom models

Model invocation logging to S3 is not configured

If logging is enabled to CloudWatch only, ensure CloudWatch log group uses CMK encryption

No Bedrock Flows found in the account

No action required

No Bedrock guardrails configured in this region

Create Bedrock guardrails with Standard tier for enhanced content filtering and protection

Could not assess this check in us-east-2. Assessment error: UnknownOperationException.

No action required on the assessed workload. Resolve the assessment prerequisite or permission issue and rerun the assessment.

No regional Bedrock resources found to assess with model evaluation jobs

No action required

No Bedrock prompt flows configured in this region

When creating prompt flows, use the ValidateFlowDefinition API to validate flow definitions before deployment

No Bedrock knowledge bases found in this region

When creating knowledge bases, specify customer-managed KMS keys for both vector store and data source encryption

No Bedrock agents configured in this region

When creating agents with action groups, ensure Lambda execution roles follow least privilege principles

No regional Bedrock resources found to assess model invocation throttling quotas

No action required

No Bedrock guardrails configured in this region

Create guardrails with all harmful-content filters enabled.

No Bedrock guardrails configured in this region

Create guardrails with Automated Reasoning policies for formal verification of model responses

No Bedrock knowledge bases found in this region

When implementing RAG applications, configure evaluation jobs to assess context relevance, response correctness, and prevent hallucinations

No Bedrock guardrails configured in this region

Create guardrails with sensitive-information filters (PII entities and/or regex patterns) to detect and redact sensitive data in prompts and model responses

No Bedrock guardrails configured in this region

Create guardrails with contextual grounding checks to detect hallucinations (ungrounded responses) and irrelevant answers, especially for RAG applications

No Bedrock agents configured in this region

When creating agents, associate a Bedrock guardrail so agent inputs and responses are filtered for harmful content, PII, and denied topics

No Bedrock agents configured in this region

When creating agents, set a conservative idleSessionTTLInSeconds to limit how long an idle session remains resumable

No imported custom Bedrock models found in this region

When importing models, specify a customer-managed KMS key for encryption to maintain control over encryption keys

No Bedrock batch inference (model invocation) jobs found in this region

When creating batch inference jobs, set outputDataConfig.s3OutputDataConfig.s3EncryptionKeyId to a customer-managed KMS key to encrypt the job output

No regional Bedrock resources found to monitor with CloudWatch alarms

No action required

No Lambda functions with Bedrock indicators were found in us-east-2; Inspector Lambda code-scanning coverage was not assessed for Bedrock-calling Lambda workloads.

No action required. If Bedrock-calling Lambda functions exist, ensure their function name, ARN, description, handler, role, or environment variables contain a Bedrock identifier that the assessment can detect, or evaluate Inspector coverage manually.

No Bedrock guardrails configured in this region

Create guardrails with a preventive PROMPT_ATTACK filter.

No Bedrock guardrails configured in this region

No action required

No application inference profiles found

No action required

No Automated Reasoning policies found

No action required

No Bedrock Marketplace model endpoints found

No action required

No Bedrock Marketplace model endpoints found

No action required

No regional Bedrock resources found to assess private connectivity

No action required

No regional Bedrock resources found to monitor with invocation logging

No action required

No regional Bedrock resources found to protect with guardrails

No action required

No regional Bedrock resources found to audit with Bedrock-specific CloudTrail coverage

No action required

Prompt Management feature is not being used. This may lead to inconsistent prompt handling and suboptimal model responses.

Implement Prompt Management to: 1. Create and version your prompts 2. Test different prompt variants 3. Share prompts across your organization 4. Maintain consistent prompt templates

No Bedrock agents found in the account

No action required

No Knowledge Bases found in the account

No action required

No guardrails configured - IAM enforcement check not applicable

Configure Bedrock Guardrails first, then enforce their use via IAM policies

No custom/fine-tuned models found in the account

No action required

Model invocation logging to S3 is not configured

If logging is enabled to CloudWatch only, ensure CloudWatch log group uses CMK encryption

No Bedrock Flows found in the account

No action required

No Bedrock guardrails configured in this region

Create Bedrock guardrails with Standard tier for enhanced content filtering and protection

No custom (fine-tuned) Bedrock models found in this region

When creating custom models, specify a customer-managed KMS key for encryption to maintain control over encryption keys

No regional Bedrock resources found to assess with model evaluation jobs

No action required

No Bedrock prompt flows configured in this region

When creating prompt flows, use the ValidateFlowDefinition API to validate flow definitions before deployment

No Bedrock knowledge bases found in this region

When creating knowledge bases, specify customer-managed KMS keys for both vector store and data source encryption

No Bedrock agents configured in this region

When creating agents with action groups, ensure Lambda execution roles follow least privilege principles

No regional Bedrock resources found to assess model invocation throttling quotas

No action required

No Bedrock guardrails configured in this region

Create guardrails with all harmful-content filters enabled.

No Bedrock guardrails configured in this region

Create guardrails with Automated Reasoning policies for formal verification of model responses

No Bedrock knowledge bases found in this region

When implementing RAG applications, configure evaluation jobs to assess context relevance, response correctness, and prevent hallucinations

No Bedrock guardrails configured in this region

Create guardrails with sensitive-information filters (PII entities and/or regex patterns) to detect and redact sensitive data in prompts and model responses

No Bedrock guardrails configured in this region

Create guardrails with contextual grounding checks to detect hallucinations (ungrounded responses) and irrelevant answers, especially for RAG applications

No Bedrock agents configured in this region

When creating agents, associate a Bedrock guardrail so agent inputs and responses are filtered for harmful content, PII, and denied topics

No Bedrock agents configured in this region

When creating agents, set a conservative idleSessionTTLInSeconds to limit how long an idle session remains resumable

No imported custom Bedrock models found in this region

When importing models, specify a customer-managed KMS key for encryption to maintain control over encryption keys

No Bedrock batch inference (model invocation) jobs found in this region

When creating batch inference jobs, set outputDataConfig.s3OutputDataConfig.s3EncryptionKeyId to a customer-managed KMS key to encrypt the job output

No regional Bedrock resources found to monitor with CloudWatch alarms

No action required

No Lambda functions with Bedrock indicators were found in us-west-2; Inspector Lambda code-scanning coverage was not assessed for Bedrock-calling Lambda workloads.

No action required. If Bedrock-calling Lambda functions exist, ensure their function name, ARN, description, handler, role, or environment variables contain a Bedrock identifier that the assessment can detect, or evaluate Inspector coverage manually.

No Bedrock guardrails configured in this region

Create guardrails with a preventive PROMPT_ATTACK filter.

No Bedrock guardrails configured in this region

No action required

No application inference profiles found

No action required

No Automated Reasoning policies found

No action required

No Bedrock Marketplace model endpoints found

No action required

No Bedrock Marketplace model endpoints found

No action required

No issues found with IAM permissions and no stale access detected

No action required

No SageMaker notebook instances or domains found to check

No action required

No SageMaker domains found, or all domains use SSO with IAM Identity Center configured

No action required

No SageMaker resources found to check for data protection

No action required

No feature groups found

Utilize SageMaker Feature Store to create, share, and manage features for machine learning development and production

No model package groups found

Implement model versioning using SageMaker Model Registry to track model lineage, approve model versions, and manage model deployment

No ML pipelines found

Implement SageMaker Pipelines to automate and manage ML workflows, including data preparation, training, and model deployment

No SageMaker Clarify jobs found

Implement SageMaker Clarify for model explainability and bias detection

No Model Monitor schedules found

Configure comprehensive model monitoring schedules

Model Registry is not being utilized

Implement proper model versioning and approval workflows

No notebook instances found

No action required

No notebook instances found

No action required

No models found

No action required

No InService endpoints found

No action required

No monitoring schedules found

No action required

No models found or all use default Platform access

No action required

No feature groups with offline stores found

No action required

No data quality job definitions found

No action required

No processing jobs found

No action required

No transform jobs found

No action required

No hyperparameter tuning jobs found

No action required

No compilation jobs found

No action required

No AutoML jobs found

No action required

No model package groups found. Model Registry is not being used for model governance.

Implement Model Registry to track model versions and enforce approval workflows before production deployment.

No InService endpoints found to monitor.

No action required

No InService endpoints found.

No action required

No SageMaker Experiments found. ML Lineage tracking through Experiments is not being utilized.

Implement SageMaker Experiments to track ML training runs, hyperparameters, metrics, and model artifacts. This enables reproducibility and auditability.

No SageMaker HyperPod clusters found

No action required

No SageMaker HyperPod clusters found

No action required

No SageMaker model package groups found

No action required

No SageMaker notebook instances or domains found to check

No action required

No SageMaker domains found, or all domains use SSO with IAM Identity Center configured

No action required

No SageMaker resources found to check for data protection

No action required

Amazon GuardDuty is properly enabled and monitoring for security threats in SageMaker workloads.

No action required

No feature groups found

Utilize SageMaker Feature Store to create, share, and manage features for machine learning development and production

No model package groups found

Implement model versioning using SageMaker Model Registry to track model lineage, approve model versions, and manage model deployment

No ML pipelines found

Implement SageMaker Pipelines to automate and manage ML workflows, including data preparation, training, and model deployment

No SageMaker Clarify jobs found

Implement SageMaker Clarify for model explainability and bias detection

No Model Monitor schedules found

Configure comprehensive model monitoring schedules

Model Registry is not being utilized

Implement proper model versioning and approval workflows

No notebook instances found

No action required

No notebook instances found

No action required

No models found

No action required

No InService endpoints found

No action required

No monitoring schedules found

No action required

No models found or all use default Platform access

No action required

No feature groups with offline stores found

No action required

No data quality job definitions found

No action required

No processing jobs found

No action required

No transform jobs found

No action required

No hyperparameter tuning jobs found

No action required

No compilation jobs found

No action required

No AutoML jobs found

No action required

No model package groups found. Model Registry is not being used for model governance.

Implement Model Registry to track model versions and enforce approval workflows before production deployment.

No InService endpoints found to monitor.

No action required

No InService endpoints found.

No action required

No SageMaker Experiments found. ML Lineage tracking through Experiments is not being utilized.

Implement SageMaker Experiments to track ML training runs, hyperparameters, metrics, and model artifacts. This enables reproducibility and auditability.

No SageMaker HyperPod clusters found

No action required

No SageMaker HyperPod clusters found

No action required

No SageMaker model package groups found

No action required

No SageMaker notebook instances or domains found to check

No action required

No SageMaker domains found, or all domains use SSO with IAM Identity Center configured

No action required

No SageMaker resources found to check for data protection

No action required

Amazon GuardDuty is properly enabled and monitoring for security threats in SageMaker workloads.

No action required

No feature groups found

Utilize SageMaker Feature Store to create, share, and manage features for machine learning development and production

No model package groups found

Implement model versioning using SageMaker Model Registry to track model lineage, approve model versions, and manage model deployment

No ML pipelines found

Implement SageMaker Pipelines to automate and manage ML workflows, including data preparation, training, and model deployment

No SageMaker Clarify jobs found

Implement SageMaker Clarify for model explainability and bias detection

No Model Monitor schedules found

Configure comprehensive model monitoring schedules

Model Registry is not being utilized

Implement proper model versioning and approval workflows