Assessment could not enumerate AWS Agent Registry registries: AccessDeniedException (Unauthorized access).

Grant agent-registry:ListRegistries and retry the assessment.

Assessment could not enumerate AWS Agent Registry registries: AccessDeniedException (Unauthorized access).

Grant agent-registry:ListRegistries and retry the assessment.

Assessment could not enumerate AWS Agent Registry registries: AccessDeniedException (Unauthorized access).

Grant agent-registry:ListRegistries and retry the assessment.

Assessment could not enumerate AWS Agent Registry registries: AccessDeniedException (Unauthorized access).

Grant agent-registry:ListRegistries and retry the assessment.

Assessment could not enumerate AWS Agent Registry registries: AccessDeniedException (Unauthorized access).

Grant agent-registry:ListRegistries and retry the assessment.

Assessment could not enumerate AWS Agent Registry registries: AccessDeniedException (Unauthorized access).

Grant agent-registry:ListRegistries and retry the assessment.

Agentic AI security domain: Agent Identity & Access. Registry approval workflows control which agents, tools, and skills become discoverable to consumers. Source check AR-03: Assessment could not enumerate AWS Agent Registry registries: AccessDeniedException (Unauthorized access).

Require manual review for registry publication where organizational policy does not permit automatic approval.

Agentic AI security domain: Agent Identity & Access. Registry discovery authorization requires review against intended callers and effective access boundaries. Source check AR-04: Assessment could not enumerate AWS Agent Registry registries: AccessDeniedException (Unauthorized access).

Review effective IAM access or compare custom JWT audiences, clients, scopes, and claims with approved registry consumers.

Agentic AI security domain: Memory & Data Privacy. Registry records can contain agent, tool, endpoint, and ownership metadata that benefits from customer-controlled encryption. Source check AR-05: Assessment could not enumerate AWS Agent Registry registries: AccessDeniedException (Unauthorized access).

Create the registry with a customer-managed KMS key when organizational policy requires customer-controlled encryption.

Agentic AI security domain: Auditability & Continuous Assurance. Organization-wide auto-detection provides visibility into unmanaged agent resources. Source check AR-06: Assessment could not enumerate AWS Agent Registry registries: AccessDeniedException (Unauthorized access).

Enable organization-scoped registry auto-detection where centralized discovery is required.

Agentic AI security domain: Agent Identity & Access. Registry lifecycle states provide operational visibility but do not independently prove a security control. Source check AR-07: Assessment could not enumerate AWS Agent Registry registries: AccessDeniedException (Unauthorized access).

Review failed or unknown record lifecycle states operationally.

Agentic AI security domain: Auditability & Continuous Assurance. Consumers need attributable record origin and source lineage to understand which account and resource produced an entry. Source check AR-08: Assessment could not enumerate AWS Agent Registry registries: AccessDeniedException (Unauthorized access).

Ensure records retain creator attribution and auto-detected records retain source provenance.

No roles with overly permissive AWS Agent Registry access found.

No action required

The following principals have AWS Agent Registry permissions but no service-last-accessed evidence: role 'AIMLSecurityMemberRole'

Review and remove unused AWS Agent Registry permissions following least privilege.

No AWS Agent Registry registries found.

No action required

No AWS Agent Registry registries found.

No action required

No AWS Agent Registry registries found.

No action required

No AWS Agent Registry registries found.

No action required

No AWS Agent Registry registries found.

No action required

No AWS Agent Registry registries found.

No action required

Agentic AI security domain: Agent Identity & Access. Registry approval workflows control which agents, tools, and skills become discoverable to consumers. Source check AR-03: No AWS Agent Registry registries found.

Require manual review for registry publication where organizational policy does not permit automatic approval.

Agentic AI security domain: Agent Identity & Access. Registry discovery authorization requires review against intended callers and effective access boundaries. Source check AR-04: No AWS Agent Registry registries found.

Review effective IAM access or compare custom JWT audiences, clients, scopes, and claims with approved registry consumers.

Agentic AI security domain: Memory & Data Privacy. Registry records can contain agent, tool, endpoint, and ownership metadata that benefits from customer-controlled encryption. Source check AR-05: No AWS Agent Registry registries found.

Create the registry with a customer-managed KMS key when organizational policy requires customer-controlled encryption.

Agentic AI security domain: Auditability & Continuous Assurance. Organization-wide auto-detection provides visibility into unmanaged agent resources. Source check AR-06: No AWS Agent Registry registries found.

Enable organization-scoped registry auto-detection where centralized discovery is required.

Agentic AI security domain: Agent Identity & Access. Registry lifecycle states provide operational visibility but do not independently prove a security control. Source check AR-07: No AWS Agent Registry registries found.

Review failed or unknown record lifecycle states operationally.

Agentic AI security domain: Auditability & Continuous Assurance. Consumers need attributable record origin and source lineage to understand which account and resource produced an entry. Source check AR-08: No AWS Agent Registry registries found.

Ensure records retain creator attribution and auto-detected records retain source provenance.

OWASP category: LLM01:2025 Prompt Injection. Source check BR-04: Model invocation logging is not enabled. This limits your ability to track and audit model usage.

Enable Bedrock model invocation logging to S3 and/or CloudWatch Logs so injection attempts and their surrounding context are captured for detection and post-incident analysis.

OWASP category: LLM07:2025 System Prompt Leakage. Source check BR-04: Model invocation logging is not enabled. This limits your ability to track and audit model usage.

Enable Bedrock model invocation logging so prompt-extraction attempts against the system prompt are auditable after the fact.

OWASP category: LLM07:2025 System Prompt Leakage. Source check BR-07: Prompt Management feature is not being used. This may lead to inconsistent prompt handling and suboptimal model responses.

Manage system prompts through Amazon Bedrock Prompt Management rather than inline code or Lambda env vars so prompts are versioned, IAM-scoped, and auditable — reducing the blast radius of a prompt-leakage incident.

OWASP category: LLM07:2025 System Prompt Leakage. Source check BR-16: Guardrail 'Sample-Guardrail' (ID: mmi5rrre65gv) could not be assessed because GetGuardrail did not report contentPolicy.tier.tierName; tier unknown and was not assumed to be CLASSIC.

Set guardrail contentPolicy.tier.tierName to STANDARD; Standard tier additionally detects prompt-leakage attacks.

OWASP category: LLM09:2025 Misinformation. Source check BR-18: No Bedrock model evaluation jobs found. Model evaluation helps assess toxicity, accuracy, semantic robustness, and other safety metrics before production deployment.

Run Bedrock model evaluation jobs that include correctness and safety datasets.

OWASP category: LLM08:2025 Vector and Embedding Weaknesses. Source check BR-20: Knowledge base 'knowledge-base-bedrock-agent' (ID: XSPYLN4FQL) uses 'OPENSEARCH_SERVERLESS' storage. The vector-store encryption key is managed at the storage layer and cannot be validated from the Knowledge Base API. Verify customer-managed KMS encryption on the underlying store.

Configure the Bedrock Managed Knowledge Base to use a customer-managed KMS key for storage encryption.

OWASP category: LLM08:2025 Vector and Embedding Weaknesses. Source check BR-20: Knowledge base 'IDP-DOCUMENTBEDROCKKB-CY8N0Q7N4YDT' (ID: SUGAG7RGYD) uses 'OPENSEARCH_SERVERLESS' storage. The vector-store encryption key is managed at the storage layer and cannot be validated from the Knowledge Base API. Verify customer-managed KMS encryption on the underlying store.

Configure the Bedrock Managed Knowledge Base to use a customer-managed KMS key for storage encryption.

OWASP category: LLM08:2025 Vector and Embedding Weaknesses. Source check BR-20: Knowledge base 'promptfoo-rag-workshop-111122223333-kb' (ID: N74ZIKTUFL) uses 'RDS' storage. The vector-store encryption key is managed at the storage layer and cannot be validated from the Knowledge Base API. Verify customer-managed KMS encryption on the underlying store.

Configure the Bedrock Managed Knowledge Base to use a customer-managed KMS key for storage encryption.

OWASP category: LLM08:2025 Vector and Embedding Weaknesses. Source check BR-20: Knowledge base 'InvestmentResearchKB' (ID: M1GMUG3BP0) uses 'OPENSEARCH_SERVERLESS' storage. The vector-store encryption key is managed at the storage layer and cannot be validated from the Knowledge Base API. Verify customer-managed KMS encryption on the underlying store.

Configure the Bedrock Managed Knowledge Base to use a customer-managed KMS key for storage encryption.

OWASP category: LLM08:2025 Vector and Embedding Weaknesses. Source check BR-20: Knowledge base 'knowledge-base-quick-start-xtwwd' (ID: ENFHSBBLMV) uses 'OPENSEARCH_SERVERLESS' storage. The vector-store encryption key is managed at the storage layer and cannot be validated from the Knowledge Base API. Verify customer-managed KMS encryption on the underlying store.

Configure the Bedrock Managed Knowledge Base to use a customer-managed KMS key for storage encryption.

OWASP category: LLM08:2025 Vector and Embedding Weaknesses. Source check BR-20: Knowledge base 'kb-s3-vector-store' (ID: 116IXQU5VP) uses 'S3_VECTORS' storage. The vector-store encryption key is managed at the storage layer and cannot be validated from the Knowledge Base API. Verify customer-managed KMS encryption on the underlying store.

Configure the Bedrock Managed Knowledge Base to use a customer-managed KMS key for storage encryption.

OWASP category: LLM06:2025 Excessive Agency. Source check BR-21: No Bedrock agents configured in this region

Restrict agent action-group Lambda roles to only the specific actions and resources needed for each tool.

OWASP category: LLM10:2025 Unbounded Consumption. Source check BR-22: 8 custom throttling quotas are configured. Regular quota review helps maintain appropriate rate limits.

Customise Bedrock TPM / RPM service quotas above the account default to establish an explicit consumption ceiling.

OWASP category: LLM01:2025 Prompt Injection. Source check BR-23: Guardrail 'Sample-Guardrail' (ID: mmi5rrre65gv) is missing content filters: HATE, INSULTS, SEXUAL, VIOLENCE.

Enable Bedrock guardrail content filters (HATE, VIOLENCE, SEXUAL, INSULTS, MISCONDUCT) at MEDIUM strength or higher, and set the PROMPT_ATTACK filter at STANDARD tier.

OWASP category: LLM04:2025 Data and Model Poisoning. Source check BR-25: Knowledge base 'knowledge-base-bedrock-agent' (ID: XSPYLN4FQL) does not have recent RAG evaluation jobs. RAG evaluations assess context relevance, response correctness, faithfulness, and harmfulness to prevent hallucinations.

Run Bedrock RAG evaluation jobs against knowledge bases regularly to detect degraded retrieval or poisoned context.

OWASP category: LLM09:2025 Misinformation. Source check BR-25: Knowledge base 'knowledge-base-bedrock-agent' (ID: XSPYLN4FQL) does not have recent RAG evaluation jobs. RAG evaluations assess context relevance, response correctness, faithfulness, and harmfulness to prevent hallucinations.

Include faithfulness and correctness metrics in RAG evaluation jobs to catch misinformation before deploying knowledge-base updates.

OWASP category: LLM04:2025 Data and Model Poisoning. Source check BR-25: Knowledge base 'IDP-DOCUMENTBEDROCKKB-CY8N0Q7N4YDT' (ID: SUGAG7RGYD) does not have recent RAG evaluation jobs. RAG evaluations assess context relevance, response correctness, faithfulness, and harmfulness to prevent hallucinations.

Run Bedrock RAG evaluation jobs against knowledge bases regularly to detect degraded retrieval or poisoned context.

OWASP category: LLM09:2025 Misinformation. Source check BR-25: Knowledge base 'IDP-DOCUMENTBEDROCKKB-CY8N0Q7N4YDT' (ID: SUGAG7RGYD) does not have recent RAG evaluation jobs. RAG evaluations assess context relevance, response correctness, faithfulness, and harmfulness to prevent hallucinations.

Include faithfulness and correctness metrics in RAG evaluation jobs to catch misinformation before deploying knowledge-base updates.

OWASP category: LLM04:2025 Data and Model Poisoning. Source check BR-25: Knowledge base 'promptfoo-rag-workshop-111122223333-kb' (ID: N74ZIKTUFL) does not have recent RAG evaluation jobs. RAG evaluations assess context relevance, response correctness, faithfulness, and harmfulness to prevent hallucinations.

Run Bedrock RAG evaluation jobs against knowledge bases regularly to detect degraded retrieval or poisoned context.

OWASP category: LLM09:2025 Misinformation. Source check BR-25: Knowledge base 'promptfoo-rag-workshop-111122223333-kb' (ID: N74ZIKTUFL) does not have recent RAG evaluation jobs. RAG evaluations assess context relevance, response correctness, faithfulness, and harmfulness to prevent hallucinations.

Include faithfulness and correctness metrics in RAG evaluation jobs to catch misinformation before deploying knowledge-base updates.

OWASP category: LLM04:2025 Data and Model Poisoning. Source check BR-25: Knowledge base 'InvestmentResearchKB' (ID: M1GMUG3BP0) does not have recent RAG evaluation jobs. RAG evaluations assess context relevance, response correctness, faithfulness, and harmfulness to prevent hallucinations.

Run Bedrock RAG evaluation jobs against knowledge bases regularly to detect degraded retrieval or poisoned context.

OWASP category: LLM09:2025 Misinformation. Source check BR-25: Knowledge base 'InvestmentResearchKB' (ID: M1GMUG3BP0) does not have recent RAG evaluation jobs. RAG evaluations assess context relevance, response correctness, faithfulness, and harmfulness to prevent hallucinations.

Include faithfulness and correctness metrics in RAG evaluation jobs to catch misinformation before deploying knowledge-base updates.

OWASP category: LLM04:2025 Data and Model Poisoning. Source check BR-25: Knowledge base 'knowledge-base-quick-start-xtwwd' (ID: ENFHSBBLMV) does not have recent RAG evaluation jobs. RAG evaluations assess context relevance, response correctness, faithfulness, and harmfulness to prevent hallucinations.

Run Bedrock RAG evaluation jobs against knowledge bases regularly to detect degraded retrieval or poisoned context.

OWASP category: LLM09:2025 Misinformation. Source check BR-25: Knowledge base 'knowledge-base-quick-start-xtwwd' (ID: ENFHSBBLMV) does not have recent RAG evaluation jobs. RAG evaluations assess context relevance, response correctness, faithfulness, and harmfulness to prevent hallucinations.

Include faithfulness and correctness metrics in RAG evaluation jobs to catch misinformation before deploying knowledge-base updates.

OWASP category: LLM04:2025 Data and Model Poisoning. Source check BR-25: Knowledge base 'kb-s3-vector-store' (ID: 116IXQU5VP) does not have recent RAG evaluation jobs. RAG evaluations assess context relevance, response correctness, faithfulness, and harmfulness to prevent hallucinations.

Run Bedrock RAG evaluation jobs against knowledge bases regularly to detect degraded retrieval or poisoned context.

OWASP category: LLM09:2025 Misinformation. Source check BR-25: Knowledge base 'kb-s3-vector-store' (ID: 116IXQU5VP) does not have recent RAG evaluation jobs. RAG evaluations assess context relevance, response correctness, faithfulness, and harmfulness to prevent hallucinations.

Include faithfulness and correctness metrics in RAG evaluation jobs to catch misinformation before deploying knowledge-base updates.

OWASP category: LLM02:2025 Sensitive Information Disclosure. Source check BR-26: Guardrail 'Sample-Guardrail' (ID: mmi5rrre65gv) has no sensitive-information filters configured (no PII entities or regex patterns). Prompts and model responses are not screened for sensitive data such as PII.

Configure guardrail sensitiveInformationPolicy with PII entities and regex patterns; set outputAction=ANONYMIZE or BLOCK.

OWASP category: LLM01:2025 Prompt Injection. Source check BR-27: Guardrail 'Sample-Guardrail' (ID: mmi5rrre65gv) does not have contextual grounding checks enabled. Without grounding and relevance checks, the guardrail cannot detect hallucinated (ungrounded) or off-topic model responses.

Enable Bedrock guardrail contextual grounding checks to reduce the surface for indirect prompt injection through retrieved context.

OWASP category: LLM04:2025 Data and Model Poisoning. Source check BR-27: Guardrail 'Sample-Guardrail' (ID: mmi5rrre65gv) does not have contextual grounding checks enabled. Without grounding and relevance checks, the guardrail cannot detect hallucinated (ungrounded) or off-topic model responses.

Enable contextual grounding guardrail filters so retrieved context that diverges from ground truth is filtered before reaching the model.

OWASP category: LLM09:2025 Misinformation. Source check BR-27: Guardrail 'Sample-Guardrail' (ID: mmi5rrre65gv) does not have contextual grounding checks enabled. Without grounding and relevance checks, the guardrail cannot detect hallucinated (ungrounded) or off-topic model responses.

Set the contextual grounding filter threshold to at least 0.70 to reduce hallucinated responses.

OWASP category: LLM06:2025 Excessive Agency. Source check BR-28: No Bedrock agents configured in this region

Attach an approved Bedrock guardrail to every Bedrock agent so autonomous actions are filtered consistently.

OWASP category: LLM06:2025 Excessive Agency. Source check BR-29: No Bedrock agents configured in this region

Set idleSessionTTLInSeconds to a conservative value (e.g., <= 3600) so long-lived agent sessions cannot be reused.

OWASP category: LLM03:2025 Supply Chain. Source check BR-30: No imported custom Bedrock models found in this region

Encrypt imported Bedrock models with a customer-managed KMS key to preserve provenance and access control across model artefacts.

OWASP category: LLM10:2025 Unbounded Consumption. Source check BR-32: No CloudWatch alarms are configured on Amazon Bedrock runtime metrics (AWS/Bedrock namespace). Without alarms, abuse, denial-of-wallet, sustained throttling, and content-filter spikes can go undetected.

Create CloudWatch alarms on Bedrock InvocationThrottles, InputTokenCount, OutputTokenCount, and EstimatedTPMQuotaUsage.

OWASP category: LLM03:2025 Supply Chain. Source check BR-33: Amazon Inspector Lambda scanning is not fully enabled in us-west-2. Lambda standard scan status: DISABLED. Lambda code scan status: DISABLED. Detected 6 Lambda function(s) with Bedrock indicators: IDP-DOCUMENTBEDROCKKB-CY8-GetAdjustedStackNameFunc-MFYZSG0nWqdj, IDP-DOCUMENTBEDROCKKB-CY8-StartIngestionJobFunctio-QGtm6KrDTRYu, IDP-DOCUMENTBEDROCKKB-CY8N0Q7N-GetSeedUrlsFunction-vCBSeTw4AdDV, IDP-PATTERN1STACK-TNHNKPKJY-ProcessResultsFunction-xLOdarbvGDm7, IDP-QueryKnowledgeBaseResolverFunction-tkmkVZ4lgxf8 (and 1 more). Without both scan types enabled, vulnerable dependencies and hardcoded secrets in these in-scope functions will not be detected.

Enable Amazon Inspector Lambda standard scanning and Lambda code scanning so vulnerable dependencies and hardcoded secrets in Bedrock-calling Lambda functions are detected as part of the GenAI supply chain.

OWASP category: LLM01:2025 Prompt Injection. Source check BR-34: Guardrail 'Sample-Guardrail' does not have a preventive PROMPT_ATTACK input filter.

Configure a preventive Bedrock Guardrails PROMPT_ATTACK input filter with BLOCK action and a non-NONE strength.

OWASP category: LLM02:2025 Sensitive Information Disclosure. Source check BR-37: Bedrock account data retention is inherit; this does not establish an explicit account-level zero-data-retention setting.

Configure Bedrock account data retention as none and disable provider data sharing when prompts or responses may contain sensitive information.

OWASP category: LLM02:2025 Sensitive Information Disclosure. Source check BR-38: No Automated Reasoning policies found

Encrypt Automated Reasoning policies with a customer-managed KMS key to protect policy definitions and associated sensitive configuration.

OWASP category: LLM03:2025 Supply Chain. Source check BR-39: No Bedrock Marketplace model endpoints found

Configure Bedrock Marketplace model endpoints with approved VPC subnets and security groups so model and dependency paths remain inside controlled network boundaries.

OWASP category: LLM02:2025 Sensitive Information Disclosure. Source check BR-40: No Bedrock Marketplace model endpoints found

Configure Bedrock Marketplace model endpoints with a customer-managed KMS key rather than an AWS-managed key.

OWASP category: LLM03:2025 Supply Chain. Source check SM-01: SageMaker domain 'd-krxh4fmtaxjl' (PromptEvaluationDomain) is not configured for VPC-only access

Disable direct internet access on SageMaker notebooks and configure domains for VPC-only access to reduce supply-chain exposure from unmanaged network paths.

OWASP category: LLM02:2025 Sensitive Information Disclosure. Source check SM-03: Domain 'PromptEvaluationDomain' - No KMS key configured

Configure SageMaker notebooks, domains, and training jobs to use customer-managed KMS keys and encryption in transit for sensitive training and inference data.

OWASP category: LLM01:2025 Prompt Injection. Source check SM-26: GuardDuty is enabled, but the AI Protection detector feature is not enabled.

Enable the GuardDuty AI_PROTECTION detector feature to detect supported direct prompt-injection activity.

OWASP category: LLM10:2025 Unbounded Consumption. Source check SM-26: GuardDuty is enabled, but the AI Protection detector feature is not enabled.

Enable the GuardDuty AI_PROTECTION detector feature to detect supported anomalous model invocation and cost-harvesting activity.

OWASP category: LLM09:2025 Misinformation. Source check SM-06: No SageMaker Clarify jobs found

Use SageMaker Clarify to evaluate bias and explainability for models whose generated outputs can influence user decisions.

OWASP category: LLM04:2025 Data and Model Poisoning. Source check SM-07: No Model Monitor schedules found

Configure active SageMaker Model Monitor schedules so data-quality and model-quality regressions caused by poisoned inputs or drift are detected.

OWASP category: LLM09:2025 Misinformation. Source check SM-07: No Model Monitor schedules found

Configure SageMaker Model Monitor schedules for production models so quality regressions that can produce incorrect outputs are detected.

OWASP category: LLM03:2025 Supply Chain. Source check SM-10: No notebook instances found

Deploy SageMaker notebook instances inside a VPC so package, data, and model artifact access can be controlled through private network paths.

OWASP category: LLM03:2025 Supply Chain. Source check SM-11: No models found

Enable network isolation on SageMaker models so inference containers cannot make unmanaged outbound calls that alter dependencies or exfiltrate model artifacts.

OWASP category: LLM10:2025 Unbounded Consumption. Source check SM-11: No models found

Enable SageMaker model network isolation to prevent deployed model containers from making uncontrolled outbound calls that can amplify consumption or abuse downstream services.

OWASP category: LLM03:2025 Supply Chain. Source check SM-14: No models found or all use default Platform access

Configure SageMaker models to pull container images from private ECR repositories through VPC repository access instead of platform or public registry paths.

OWASP category: LLM02:2025 Sensitive Information Disclosure. Source check SM-15: No feature groups with offline stores found

Encrypt SageMaker Feature Store offline stores with customer-managed KMS keys so sensitive feature data is protected at rest.

OWASP category: LLM03:2025 Supply Chain. Source check SM-21: No AutoML jobs found

Enable network isolation on AutoML jobs so generated training containers cannot fetch unapproved dependencies or send data over unmanaged network paths.

OWASP category: LLM04:2025 Data and Model Poisoning. Source check SM-22: No model package groups found. Model Registry is not being used for model governance.

Require SageMaker Model Registry approval workflows before production deployment so poisoned or unreviewed model versions are not promoted automatically.

OWASP category: LLM09:2025 Misinformation. Source check SM-22: No model package groups found. Model Registry is not being used for model governance.

Use SageMaker Model Registry approval workflows to ensure model behavior, intended use, and validation evidence are reviewed before production release.

OWASP category: LLM04:2025 Data and Model Poisoning. Source check SM-23: No InService endpoints found to monitor.

Enable SageMaker Model Monitor drift detection for production endpoints so poisoning, data drift, and model-quality degradation are identified.

OWASP category: LLM09:2025 Misinformation. Source check SM-23: No InService endpoints found to monitor.

Configure data-quality and model-quality monitoring for SageMaker endpoints so degraded model behavior that can produce misinformation is detected.

OWASP category: LLM03:2025 Supply Chain. Source check SM-25: No SageMaker Experiments found. ML Lineage tracking through Experiments is not being utilized.

Use SageMaker Experiments and lineage associations to track training runs, parameters, artifacts, and model package provenance across the ML supply chain.

OWASP category: LLM04:2025 Data and Model Poisoning. Source check SM-25: No SageMaker Experiments found. ML Lineage tracking through Experiments is not being utilized.

Track SageMaker training lineage from source data through model artifacts so poisoned data or model versions can be traced and remediated.

OWASP category: LLM02:2025 Sensitive Information Disclosure. Source check SM-27: No SageMaker HyperPod clusters found

Encrypt HyperPod root and secondary EBS volumes with customer-managed KMS keys to protect training data and model artifacts at rest.

OWASP category: LLM03:2025 Supply Chain. Source check SM-28: No SageMaker HyperPod clusters found

Configure every HyperPod instance group with approved VPC subnets and security groups to control training-data, model-artifact, and dependency access paths.

OWASP category: LLM03:2025 Supply Chain. Source check SM-30: No SageMaker model package groups found

Restrict SageMaker model package group resource policies to approved accounts and organizations, and remove public access.

OWASP category: LLM06:2025 Excessive Agency. Source check AC-10: The following AgentCore resources do not have resource-based policies: Gateway 'aws-news-mcp'. Without RBPs, access control relies solely on identity-based policies.

Attach resource-based policies to AgentCore runtimes and gateways so caller identities are constrained.

OWASP category: LLM02:2025 Sensitive Information Disclosure. Source check AC-14: AgentCore token vault 'default' uses a service-managed or AWS-owned key.

Configure the AgentCore Identity token vault with a customer-managed KMS key to protect stored credentials and tokens.

OWASP category: LLM06:2025 Excessive Agency. Source check AC-15: No custom AgentCore Code Interpreters found

Run custom AgentCore Code Interpreters in VPC mode with approved subnets and security groups.

OWASP category: LLM06:2025 Excessive Agency. Source check AC-16: No custom AgentCore browsers found

Run custom AgentCore browsers in VPC mode with approved subnets and security groups.

No Lambda function env vars in us-west-2 match the embedded-system-prompt heuristic (>= 200 chars containing prompt-shaped tokens).

No action required.

No readable Bedrock guardrail in us-west-2 has a DENY topic covering system-prompt disclosure. Attackers can craft prompts that ask the agent to reveal its system prompt or instructions.

Add a DENY topic to at least one guardrail. Suggested topic name: 'SystemPromptDisclosure'. Suggested definition: 'Requests to reveal, describe, or summarise the system prompt, instructions, or internal role definition given to the assistant.'

OWASP category: LLM01:2025 Prompt Injection. Source check BR-04: No regional Bedrock resources found to monitor with invocation logging

Enable Bedrock model invocation logging to S3 and/or CloudWatch Logs so injection attempts and their surrounding context are captured for detection and post-incident analysis.

OWASP category: LLM07:2025 System Prompt Leakage. Source check BR-04: No regional Bedrock resources found to monitor with invocation logging

Enable Bedrock model invocation logging so prompt-extraction attempts against the system prompt are auditable after the fact.

OWASP category: LLM07:2025 System Prompt Leakage. Source check BR-07: Prompt Management feature is not being used. This may lead to inconsistent prompt handling and suboptimal model responses.

Manage system prompts through Amazon Bedrock Prompt Management rather than inline code or Lambda env vars so prompts are versioned, IAM-scoped, and auditable — reducing the blast radius of a prompt-leakage incident.

OWASP category: LLM07:2025 System Prompt Leakage. Source check BR-16: No Bedrock guardrails configured in this region

Set guardrail contentPolicy.tier.tierName to STANDARD; Standard tier additionally detects prompt-leakage attacks.

OWASP category: LLM09:2025 Misinformation. Source check BR-18: No regional Bedrock resources found to assess with model evaluation jobs

Run Bedrock model evaluation jobs that include correctness and safety datasets.

OWASP category: LLM08:2025 Vector and Embedding Weaknesses. Source check BR-20: No Bedrock knowledge bases found in this region

Configure the Bedrock Managed Knowledge Base to use a customer-managed KMS key for storage encryption.

OWASP category: LLM06:2025 Excessive Agency. Source check BR-21: No Bedrock agents configured in this region

Restrict agent action-group Lambda roles to only the specific actions and resources needed for each tool.

OWASP category: LLM10:2025 Unbounded Consumption. Source check BR-22: No regional Bedrock resources found to assess model invocation throttling quotas

Customise Bedrock TPM / RPM service quotas above the account default to establish an explicit consumption ceiling.

OWASP category: LLM01:2025 Prompt Injection. Source check BR-23: No Bedrock guardrails configured in this region

Enable Bedrock guardrail content filters (HATE, VIOLENCE, SEXUAL, INSULTS, MISCONDUCT) at MEDIUM strength or higher, and set the PROMPT_ATTACK filter at STANDARD tier.

OWASP category: LLM04:2025 Data and Model Poisoning. Source check BR-25: No Bedrock knowledge bases found in this region

Run Bedrock RAG evaluation jobs against knowledge bases regularly to detect degraded retrieval or poisoned context.

OWASP category: LLM09:2025 Misinformation. Source check BR-25: No Bedrock knowledge bases found in this region

Include faithfulness and correctness metrics in RAG evaluation jobs to catch misinformation before deploying knowledge-base updates.

OWASP category: LLM02:2025 Sensitive Information Disclosure. Source check BR-26: No Bedrock guardrails configured in this region

Configure guardrail sensitiveInformationPolicy with PII entities and regex patterns; set outputAction=ANONYMIZE or BLOCK.

OWASP category: LLM01:2025 Prompt Injection. Source check BR-27: No Bedrock guardrails configured in this region

Enable Bedrock guardrail contextual grounding checks to reduce the surface for indirect prompt injection through retrieved context.

OWASP category: LLM04:2025 Data and Model Poisoning. Source check BR-27: No Bedrock guardrails configured in this region

Enable contextual grounding guardrail filters so retrieved context that diverges from ground truth is filtered before reaching the model.

OWASP category: LLM09:2025 Misinformation. Source check BR-27: No Bedrock guardrails configured in this region

Set the contextual grounding filter threshold to at least 0.70 to reduce hallucinated responses.

OWASP category: LLM06:2025 Excessive Agency. Source check BR-28: No Bedrock agents configured in this region

Attach an approved Bedrock guardrail to every Bedrock agent so autonomous actions are filtered consistently.

OWASP category: LLM06:2025 Excessive Agency. Source check BR-29: No Bedrock agents configured in this region

Set idleSessionTTLInSeconds to a conservative value (e.g., <= 3600) so long-lived agent sessions cannot be reused.

OWASP category: LLM03:2025 Supply Chain. Source check BR-30: No imported custom Bedrock models found in this region

Encrypt imported Bedrock models with a customer-managed KMS key to preserve provenance and access control across model artefacts.

OWASP category: LLM10:2025 Unbounded Consumption. Source check BR-32: No regional Bedrock resources found to monitor with CloudWatch alarms

Create CloudWatch alarms on Bedrock InvocationThrottles, InputTokenCount, OutputTokenCount, and EstimatedTPMQuotaUsage.

OWASP category: LLM03:2025 Supply Chain. Source check BR-33: No Lambda functions with Bedrock indicators were found in us-east-2; Inspector Lambda code-scanning coverage was not assessed for Bedrock-calling Lambda workloads.

Enable Amazon Inspector Lambda standard scanning and Lambda code scanning so vulnerable dependencies and hardcoded secrets in Bedrock-calling Lambda functions are detected as part of the GenAI supply chain.

OWASP category: LLM01:2025 Prompt Injection. Source check BR-34: No Bedrock guardrails configured in this region

Configure a preventive Bedrock Guardrails PROMPT_ATTACK input filter with BLOCK action and a non-NONE strength.

OWASP category: LLM02:2025 Sensitive Information Disclosure. Source check BR-37: Bedrock account data retention is inherit; this does not establish an explicit account-level zero-data-retention setting.

Configure Bedrock account data retention as none and disable provider data sharing when prompts or responses may contain sensitive information.

OWASP category: LLM02:2025 Sensitive Information Disclosure. Source check BR-38: No Automated Reasoning policies found

Encrypt Automated Reasoning policies with a customer-managed KMS key to protect policy definitions and associated sensitive configuration.

OWASP category: LLM03:2025 Supply Chain. Source check BR-39: No Bedrock Marketplace model endpoints found

Configure Bedrock Marketplace model endpoints with approved VPC subnets and security groups so model and dependency paths remain inside controlled network boundaries.

OWASP category: LLM02:2025 Sensitive Information Disclosure. Source check BR-40: No Bedrock Marketplace model endpoints found

Configure Bedrock Marketplace model endpoints with a customer-managed KMS key rather than an AWS-managed key.

OWASP category: LLM03:2025 Supply Chain. Source check SM-01: No SageMaker notebook instances or domains found to check

Disable direct internet access on SageMaker notebooks and configure domains for VPC-only access to reduce supply-chain exposure from unmanaged network paths.

OWASP category: LLM02:2025 Sensitive Information Disclosure. Source check SM-03: Training Job 'xgboost-2021-12-19-01-07-45-798' - No output encryption configured

Configure SageMaker notebooks, domains, and training jobs to use customer-managed KMS keys and encryption in transit for sensitive training and inference data.

OWASP category: LLM02:2025 Sensitive Information Disclosure. Source check SM-03: Training Job 'xgboost-2021-12-19-01-07-45-798' - Inter-container traffic encryption not enabled

Configure SageMaker notebooks, domains, and training jobs to use customer-managed KMS keys and encryption in transit for sensitive training and inference data.

OWASP category: LLM01:2025 Prompt Injection. Source check SM-26: GuardDuty is enabled, but the AI Protection detector feature is not enabled.

Enable the GuardDuty AI_PROTECTION detector feature to detect supported direct prompt-injection activity.

OWASP category: LLM10:2025 Unbounded Consumption. Source check SM-26: GuardDuty is enabled, but the AI Protection detector feature is not enabled.

Enable the GuardDuty AI_PROTECTION detector feature to detect supported anomalous model invocation and cost-harvesting activity.

OWASP category: LLM09:2025 Misinformation. Source check SM-06: No SageMaker Clarify jobs found

Use SageMaker Clarify to evaluate bias and explainability for models whose generated outputs can influence user decisions.

OWASP category: LLM04:2025 Data and Model Poisoning. Source check SM-07: No Model Monitor schedules found

Configure active SageMaker Model Monitor schedules so data-quality and model-quality regressions caused by poisoned inputs or drift are detected.

OWASP category: LLM09:2025 Misinformation. Source check SM-07: No Model Monitor schedules found

Configure SageMaker Model Monitor schedules for production models so quality regressions that can produce incorrect outputs are detected.

OWASP category: LLM03:2025 Supply Chain. Source check SM-10: No notebook instances found

Deploy SageMaker notebook instances inside a VPC so package, data, and model artifact access can be controlled through private network paths.

OWASP category: LLM03:2025 Supply Chain. Source check SM-11: Model 'xgboost-2021-12-19-01-25-44-527' does not have network isolation enabled. Model containers can make outbound network calls, potentially exfiltrating data.

Enable network isolation on SageMaker models so inference containers cannot make unmanaged outbound calls that alter dependencies or exfiltrate model artifacts.

OWASP category: LLM10:2025 Unbounded Consumption. Source check SM-11: Model 'xgboost-2021-12-19-01-25-44-527' does not have network isolation enabled. Model containers can make outbound network calls, potentially exfiltrating data.

Enable SageMaker model network isolation to prevent deployed model containers from making uncontrolled outbound calls that can amplify consumption or abuse downstream services.

OWASP category: LLM03:2025 Supply Chain. Source check SM-14: Model 'xgboost-2021-12-19-01-25-44-527' uses Platform repository access mode. Container images are pulled from public/external registries, exposing supply chain risks.

Configure SageMaker models to pull container images from private ECR repositories through VPC repository access instead of platform or public registry paths.

OWASP category: LLM02:2025 Sensitive Information Disclosure. Source check SM-15: No feature groups with offline stores found

Encrypt SageMaker Feature Store offline stores with customer-managed KMS keys so sensitive feature data is protected at rest.

OWASP category: LLM03:2025 Supply Chain. Source check SM-21: No AutoML jobs found

Enable network isolation on AutoML jobs so generated training containers cannot fetch unapproved dependencies or send data over unmanaged network paths.

OWASP category: LLM04:2025 Data and Model Poisoning. Source check SM-22: No model package groups found. Model Registry is not being used for model governance.

Require SageMaker Model Registry approval workflows before production deployment so poisoned or unreviewed model versions are not promoted automatically.

OWASP category: LLM09:2025 Misinformation. Source check SM-22: No model package groups found. Model Registry is not being used for model governance.

Use SageMaker Model Registry approval workflows to ensure model behavior, intended use, and validation evidence are reviewed before production release.

OWASP category: LLM04:2025 Data and Model Poisoning. Source check SM-23: No InService endpoints found to monitor.

Enable SageMaker Model Monitor drift detection for production endpoints so poisoning, data drift, and model-quality degradation are identified.

OWASP category: LLM09:2025 Misinformation. Source check SM-23: No InService endpoints found to monitor.

Configure data-quality and model-quality monitoring for SageMaker endpoints so degraded model behavior that can produce misinformation is detected.

OWASP category: LLM03:2025 Supply Chain. Source check SM-25: No SageMaker Experiments found. ML Lineage tracking through Experiments is not being utilized.

Use SageMaker Experiments and lineage associations to track training runs, parameters, artifacts, and model package provenance across the ML supply chain.

OWASP category: LLM04:2025 Data and Model Poisoning. Source check SM-25: No SageMaker Experiments found. ML Lineage tracking through Experiments is not being utilized.

Track SageMaker training lineage from source data through model artifacts so poisoned data or model versions can be traced and remediated.

OWASP category: LLM02:2025 Sensitive Information Disclosure. Source check SM-27: No SageMaker HyperPod clusters found

Encrypt HyperPod root and secondary EBS volumes with customer-managed KMS keys to protect training data and model artifacts at rest.

OWASP category: LLM03:2025 Supply Chain. Source check SM-28: No SageMaker HyperPod clusters found

Configure every HyperPod instance group with approved VPC subnets and security groups to control training-data, model-artifact, and dependency access paths.

OWASP category: LLM03:2025 Supply Chain. Source check SM-30: No SageMaker model package groups found

Restrict SageMaker model package group resource policies to approved accounts and organizations, and remove public access.

OWASP category: LLM06:2025 Excessive Agency. Source check AC-10: No AgentCore resources found to check for resource-based policies

Attach resource-based policies to AgentCore runtimes and gateways so caller identities are constrained.

OWASP category: LLM02:2025 Sensitive Information Disclosure. Source check AC-14: No assessable AgentCore Identity token vault was found.

Configure the AgentCore Identity token vault with a customer-managed KMS key to protect stored credentials and tokens.

OWASP category: LLM06:2025 Excessive Agency. Source check AC-15: No custom AgentCore Code Interpreters found

Run custom AgentCore Code Interpreters in VPC mode with approved subnets and security groups.

OWASP category: LLM06:2025 Excessive Agency. Source check AC-16: No custom AgentCore browsers found

Run custom AgentCore browsers in VPC mode with approved subnets and security groups.

No Lambda function env vars in us-east-2 match the embedded-system-prompt heuristic (>= 200 chars containing prompt-shaped tokens).

No action required.

No Bedrock guardrails configured in us-east-2; nothing to inspect.

No action required.

Role 'ClaudeCodeWorkshop-CodeEditorInstanceBootstrapRole-GWdiq3M0J6tF' has AmazonBedrockFullAccess policy attached

Limit the AmazonBedrockFullAccess policy only to required access

Role 'IDPSageMakerCfnStack-SageMakerExecutionRole-aqrHz6dVkoHC' has AmazonBedrockFullAccess policy attached

Limit the AmazonBedrockFullAccess policy only to required access

Role 'LLMEvaluationPromptfoo-SageMakerExecutionRole-M69xCHJ9c3LU' has AmazonBedrockFullAccess policy attached

Limit the AmazonBedrockFullAccess policy only to required access

Role 'myAskMeAnything-role-kmsizqwf' has AmazonBedrockFullAccess policy attached

Limit the AmazonBedrockFullAccess policy only to required access

Role 'AmazonBedrockAgentCoreSDKRuntime-us-east-1-a6ddf3fc76' has overly permissive marketplace subscription access through policy 'BedrockAgentCoreRuntimeExecutionPolicy-cdk_agent_core'

Ensure that users have access to only the models that you want user to be able to subscribe to based on your organizational policies. For example, you may want users to have access to only text based models and not image and video generation model. This can also help to keep cost in check.

Role 'AmazonBedrockAgentCoreSDKRuntime-us-east-1-ed660add8b' has overly permissive marketplace subscription access through policy 'BedrockAgentCoreRuntimeExecutionPolicy-neoCyan_Agent'

Ensure that users have access to only the models that you want user to be able to subscribe to based on your organizational policies. For example, you may want users to have access to only text based models and not image and video generation model. This can also help to keep cost in check.

Role 'AmazonBedrockExecutionRoleForKnowledgeBase_knnc9' has overly permissive marketplace subscription access through policy 'AmazonBedrockFoundationModelPolicyForKnowledgeBase_knnc9'

Ensure that users have access to only the models that you want user to be able to subscribe to based on your organizational policies. For example, you may want users to have access to only text based models and not image and video generation model. This can also help to keep cost in check.

Role 'AmazonBedrockExecutionRoleForKnowledgeBase_qxqw2' has overly permissive marketplace subscription access through policy 'AmazonBedrockFoundationModelPolicyForKnowledgeBase_qxqw2'

Ensure that users have access to only the models that you want user to be able to subscribe to based on your organizational policies. For example, you may want users to have access to only text based models and not image and video generation model. This can also help to keep cost in check.

Role 'AmazonSageMaker-ExecutionRole-20250525T153161' has overly permissive marketplace subscription access through policy 'AmazonBedrockLimitedAccess'

Ensure that users have access to only the models that you want user to be able to subscribe to based on your organizational policies. For example, you may want users to have access to only text based models and not image and video generation model. This can also help to keep cost in check.

Role 'ClaudeCodeWorkshop-BedrockAccessLambdaRole-W3h1ES7F7R7K' has overly permissive marketplace subscription access through policy 'BedrockModelAccessGrant'

Ensure that users have access to only the models that you want user to be able to subscribe to based on your organizational policies. For example, you may want users to have access to only text based models and not image and video generation model. This can also help to keep cost in check.

Role 'ClaudeCodeWorkshop-CodeEditorInstanceBootstrapRole-GWdiq3M0J6tF' has overly permissive marketplace subscription access through policy 'AmazonBedrockFullAccess'

Ensure that users have access to only the models that you want user to be able to subscribe to based on your organizational policies. For example, you may want users to have access to only text based models and not image and video generation model. This can also help to keep cost in check.

Role 'IDPSageMakerCfnStack-SageMakerExecutionRole-aqrHz6dVkoHC' has overly permissive marketplace subscription access through policy 'AmazonBedrockFullAccess'

Ensure that users have access to only the models that you want user to be able to subscribe to based on your organizational policies. For example, you may want users to have access to only text based models and not image and video generation model. This can also help to keep cost in check.

Role 'LLMEvaluationPromptfoo-SageMakerExecutionRole-M69xCHJ9c3LU' has overly permissive marketplace subscription access through policy 'AmazonBedrockFullAccess'

Ensure that users have access to only the models that you want user to be able to subscribe to based on your organizational policies. For example, you may want users to have access to only text based models and not image and video generation model. This can also help to keep cost in check.

Role 'myAskMeAnything-role-kmsizqwf' has overly permissive marketplace subscription access through policy 'AmazonBedrockFullAccess'

Ensure that users have access to only the models that you want user to be able to subscribe to based on your organizational policies. For example, you may want users to have access to only text based models and not image and video generation model. This can also help to keep cost in check.

User 'BedrockAPIKey-20pp' has overly permissive marketplace subscription access through policy 'AmazonBedrockLimitedAccess'

Ensure that users have access to only the models that you want user to be able to subscribe to based on your organizational policies. For example, you may want users to have access to only text based models and not image and video generation model. This can also help to keep cost in check.

User 'BedrockAPIKey-yhc3' has overly permissive marketplace subscription access through policy 'AmazonBedrockLimitedAccess'

Ensure that users have access to only the models that you want user to be able to subscribe to based on your organizational policies. For example, you may want users to have access to only text based models and not image and video generation model. This can also help to keep cost in check.

User 'BedrockClientUser' has overly permissive marketplace subscription access through policy 'AmazonBedrockFullAccess'

Ensure that users have access to only the models that you want user to be able to subscribe to based on your organizational policies. For example, you may want users to have access to only text based models and not image and video generation model. This can also help to keep cost in check.

No Bedrock service VPC endpoints found in VPCs: vpc-03472be90d65c2f68, vpc-39319f44, vpc-064f3e808e378cbc8, vpc-02d020a365a06c7fe

Create a VPC endpoint in your VPC with any of the following Bedrock service endpoints that your application may be using: - com.amazonaws.region.bedrock - com.amazonaws.region.bedrock-runtime - com.amazonaws.region.bedrock-agent - com.amazonaws.region.bedrock-agent-runtime

Model invocation logging is not enabled. This limits your ability to track and audit model usage.

Enable model invocation logging to collect invocation logs, model input data, and model output data. Configure logging to deliver to Amazon S3, CloudWatch Logs, or both for comprehensive monitoring.

No Amazon Bedrock Guardrails are configured. This may expose your application to potential risks such as harmful content, sensitive information disclosure, or hallucinations.

Configure Bedrock Guardrails to implement safeguards such as: - Content filters to block harmful content - Denied topics to prevent undesirable discussions - Sensitive information filters to protect PII - Contextual grounding checks to prevent hallucinations

CloudTrail is properly configured to log Bedrock API activity in trails: GuardTrail-DO-NOT-DELETE

No action required. Continue monitoring CloudTrail logs for Bedrock activity.

Prompt Management feature is not being used. This may lead to inconsistent prompt handling and suboptimal model responses.

Implement Prompt Management to: 1. Create and version your prompts 2. Test different prompt variants 3. Share prompts across your organization 4. Maintain consistent prompt templates

No Bedrock agents found in the account

No action required

Knowledge Base 'knowledge-base-semiconductors' (RQYFDSE1LT) uses 'OPENSEARCH_SERVERLESS' storage. Encryption is managed at the storage layer and cannot be validated from the KB API. Verify encryption configuration on the underlying storage resource.

1. For OpenSearch Serverless: Verify encryption with CMK at collection level 2. For S3 data sources: Verify CMK-encrypted S3 buckets 3. For RDS: Verify KMS encryption on the database 4. Consider using CMK for transient data during ingestion

Knowledge Base '111122223333-us-east-1-kb' (PAJOKBSIMQ) uses 'S3_VECTORS' storage. Encryption is managed at the storage layer and cannot be validated from the KB API. Verify encryption configuration on the underlying storage resource.

1. For OpenSearch Serverless: Verify encryption with CMK at collection level 2. For S3 data sources: Verify CMK-encrypted S3 buckets 3. For RDS: Verify KMS encryption on the database 4. Consider using CMK for transient data during ingestion

Knowledge Base 'e2e-rag-knowledgebase' (ESIYAYSYTJ) uses 'OPENSEARCH_SERVERLESS' storage. Encryption is managed at the storage layer and cannot be validated from the KB API. Verify encryption configuration on the underlying storage resource.

1. For OpenSearch Serverless: Verify encryption with CMK at collection level 2. For S3 data sources: Verify CMK-encrypted S3 buckets 3. For RDS: Verify KMS encryption on the database 4. Consider using CMK for transient data during ingestion

No guardrails configured - IAM enforcement check not applicable

Configure Bedrock Guardrails first, then enforce their use via IAM policies

No custom/fine-tuned models found in the account

No action required

Model invocation logging to S3 is not configured

If logging is enabled to CloudWatch only, ensure CloudWatch log group uses CMK encryption

No Bedrock Flows found in the account

No action required

No account-level enforced guardrail configuration was observed, and organization policy inheritance cannot be fully established from this member account.

Run the assessment from the management or delegated administrator account, or configure account-level enforced guardrails.

No Bedrock guardrails configured in this region

Create Bedrock guardrails with Standard tier for enhanced content filtering and protection

No custom (fine-tuned) Bedrock models found in this region

When creating custom models, specify a customer-managed KMS key for encryption to maintain control over encryption keys

No Bedrock model evaluation jobs found. Model evaluation helps assess toxicity, accuracy, semantic robustness, and other safety metrics before production deployment.

Create model evaluation jobs using Amazon Bedrock Evaluations to assess foundation model performance against safety and quality metrics. Use built-in datasets or custom test sets. Enable LLM-as-a-judge evaluation for comprehensive assessment.

No Bedrock prompt flows configured in this region

When creating prompt flows, use the ValidateFlowDefinition API to validate flow definitions before deployment

Knowledge base 'knowledge-base-semiconductors' (ID: RQYFDSE1LT) uses 'OPENSEARCH_SERVERLESS' storage. The vector-store encryption key is managed at the storage layer and cannot be validated from the Knowledge Base API. Verify customer-managed KMS encryption on the underlying store.

1. For OpenSearch Serverless: verify the collection uses a customer-managed KMS key 2. For Amazon RDS/Aurora: verify KMS encryption on the database 3. For third-party stores (Pinecone, Redis, MongoDB): verify the provider's encryption configuration 4. Verify the customer-managed KMS key used for transient data during ingestion

Knowledge base '111122223333-us-east-1-kb' (ID: PAJOKBSIMQ) uses 'S3_VECTORS' storage. The vector-store encryption key is managed at the storage layer and cannot be validated from the Knowledge Base API. Verify customer-managed KMS encryption on the underlying store.

1. For OpenSearch Serverless: verify the collection uses a customer-managed KMS key 2. For Amazon RDS/Aurora: verify KMS encryption on the database 3. For third-party stores (Pinecone, Redis, MongoDB): verify the provider's encryption configuration 4. Verify the customer-managed KMS key used for transient data during ingestion

Knowledge base 'e2e-rag-knowledgebase' (ID: ESIYAYSYTJ) uses 'OPENSEARCH_SERVERLESS' storage. The vector-store encryption key is managed at the storage layer and cannot be validated from the Knowledge Base API. Verify customer-managed KMS encryption on the underlying store.

1. For OpenSearch Serverless: verify the collection uses a customer-managed KMS key 2. For Amazon RDS/Aurora: verify KMS encryption on the database 3. For third-party stores (Pinecone, Redis, MongoDB): verify the provider's encryption configuration 4. Verify the customer-managed KMS key used for transient data during ingestion

No Bedrock agents configured in this region

When creating agents with action groups, ensure Lambda execution roles follow least privilege principles

10 custom throttling quotas are configured. Regular quota review helps maintain appropriate rate limits.

Continue monitoring quota utilization. Review and adjust quotas as application requirements change.

No Bedrock guardrails configured in this region

Create guardrails with all harmful-content filters enabled.

No Bedrock guardrails configured in this region

Create guardrails with Automated Reasoning policies for formal verification of model responses

Knowledge base 'knowledge-base-semiconductors' (ID: RQYFDSE1LT) does not have recent RAG evaluation jobs. RAG evaluations assess context relevance, response correctness, faithfulness, and harmfulness to prevent hallucinations.

Create RAG evaluation jobs for knowledge bases using Amazon Bedrock Model Evaluation. Configure evaluations to test context relevance, answer correctness, and faithfulness metrics. Run evaluations regularly (monthly or after significant KB updates) to maintain quality.

Knowledge base '111122223333-us-east-1-kb' (ID: PAJOKBSIMQ) does not have recent RAG evaluation jobs. RAG evaluations assess context relevance, response correctness, faithfulness, and harmfulness to prevent hallucinations.

Create RAG evaluation jobs for knowledge bases using Amazon Bedrock Model Evaluation. Configure evaluations to test context relevance, answer correctness, and faithfulness metrics. Run evaluations regularly (monthly or after significant KB updates) to maintain quality.

Knowledge base 'e2e-rag-knowledgebase' (ID: ESIYAYSYTJ) does not have recent RAG evaluation jobs. RAG evaluations assess context relevance, response correctness, faithfulness, and harmfulness to prevent hallucinations.

Create RAG evaluation jobs for knowledge bases using Amazon Bedrock Model Evaluation. Configure evaluations to test context relevance, answer correctness, and faithfulness metrics. Run evaluations regularly (monthly or after significant KB updates) to maintain quality.

No Bedrock guardrails configured in this region

Create guardrails with sensitive-information filters (PII entities and/or regex patterns) to detect and redact sensitive data in prompts and model responses

No Bedrock guardrails configured in this region

Create guardrails with contextual grounding checks to detect hallucinations (ungrounded responses) and irrelevant answers, especially for RAG applications

No Bedrock agents configured in this region

When creating agents, associate a Bedrock guardrail so agent inputs and responses are filtered for harmful content, PII, and denied topics

No Bedrock agents configured in this region

When creating agents, set a conservative idleSessionTTLInSeconds to limit how long an idle session remains resumable

No imported custom Bedrock models found in this region

When importing models, specify a customer-managed KMS key for encryption to maintain control over encryption keys

No Bedrock batch inference (model invocation) jobs found in this region

When creating batch inference jobs, set outputDataConfig.s3OutputDataConfig.s3EncryptionKeyId to a customer-managed KMS key to encrypt the job output

No CloudWatch alarms are configured on Amazon Bedrock runtime metrics (AWS/Bedrock namespace). Without alarms, abuse, denial-of-wallet, sustained throttling, and content-filter spikes can go undetected.

Create CloudWatch alarms on AWS/Bedrock runtime metrics such as Invocations, InvocationThrottles, InputTokenCount, OutputTokenCount, and ContentFilteredCount, and route them to an Amazon SNS topic for notification.

Amazon Inspector Lambda scanning is not fully enabled in us-east-1. Lambda standard scan status: ENABLED. Lambda code scan status: DISABLED. Detected 8 Lambda function(s) with Bedrock indicators: ClaudeCoworkEnvironment-BedrockApiKeyLambda-pPWYTtBWqHtH, aiml-security-aiml-security-111122223333-BedrockAssessment, gateway_lambda, myAskMeAnything, resco-aiml-BedrockAssessment (and 3 more). Without both scan types enabled, vulnerable dependencies and hardcoded secrets in these in-scope functions will not be detected.

Enable both Lambda standard scanning and Lambda code scanning in Amazon Inspector for this account and region. Console: Inspector -> Account management -> Activate for Lambda functions and Lambda code.

No Bedrock guardrails configured in this region

Create guardrails with a preventive PROMPT_ATTACK filter.

No Bedrock guardrails configured in this region

No action required

Application inference profile 'my-app-profile' is untagged.

Add organization-defined ownership, application, environment, and cost-allocation tags.

Bedrock account data retention is inherit; this does not establish an explicit account-level zero-data-retention setting.

Set the account data-retention mode to none.

No Automated Reasoning policies found

No action required

No Bedrock Marketplace model endpoints found

No action required

No Bedrock Marketplace model endpoints found

No action required

Agentic AI security domain: Auditability & Observability. Agents can take multi-step actions, so prompt, response, and guardrail traces need to be available for investigation. Source check BR-04: Model invocation logging is not enabled. This limits your ability to track and audit model usage.

Enable Amazon Bedrock model invocation logging and retain logs according to your incident response and data governance requirements.

Agentic AI security domain: Auditability & Observability. Agent activity must be attributable through CloudTrail events for Bedrock control plane and runtime operations. Source check BR-06: CloudTrail is properly configured to log Bedrock API activity in trails: GuardTrail-DO-NOT-DELETE

Enable CloudTrail trails with management event logging and validate that Bedrock API activity is captured.

Agentic AI security domain: Guardrail Enforcement. Organization-level guardrail enforcement helps prevent agents from bypassing required safety controls across accounts. Source check BR-15: No account-level enforced guardrail configuration was observed, and organization policy inheritance cannot be fully established from this member account.

Use IAM and organization controls to require approved guardrails for model and agent invocations where supported.

Agentic AI security domain: Prompt & Input Protection. Agentic applications should be tested for adversarial prompts and unsafe behaviors before production use. Source check BR-18: No Bedrock model evaluation jobs found. Model evaluation helps assess toxicity, accuracy, semantic robustness, and other safety metrics before production deployment.

Configure model or application evaluations that include adversarial, safety, and security-relevant test cases.

Agentic AI security domain: Prompt & Input Protection. Validated prompt flows reduce the risk that malformed orchestration logic causes unsafe agent behavior. Source check BR-19: No Bedrock prompt flows configured in this region

Validate Bedrock flow definitions before deployment and remediate validation findings before publishing new versions.

Agentic AI security domain: Tool Authorization. Agent action groups are tool execution boundaries; over-permissive roles can let an agent perform unintended operations. Source check BR-21: No Bedrock agents configured in this region

Restrict action group Lambda roles and referenced IAM permissions to the specific tools, resources, and actions required.

Agentic AI security domain: Abuse & Cost Protection. Autonomous agents can amplify token usage through retries, loops, or high-volume tool workflows. Source check BR-22: 10 custom throttling quotas are configured. Regular quota review helps maintain appropriate rate limits.

Configure service quotas, throttling limits, and alerting to detect and limit abnormal model invocation patterns.

Agentic AI security domain: Guardrail Enforcement. Agents should use guardrails that filter harmful content in both intermediate and final responses. Source check BR-23: No Bedrock guardrails configured in this region

Configure guardrails with appropriate content filters and thresholds for all agent-facing workloads.

Agentic AI security domain: Guardrail Enforcement. Automated reasoning policies help verify agent responses against deterministic business or safety rules. Source check BR-24: No Bedrock guardrails configured in this region

Configure automated reasoning policies on guardrails where formal response validation is required.

Agentic AI security domain: Memory & Data Privacy. Agents can receive and produce sensitive data across conversations, tool calls, and retrieved context. Source check BR-26: No Bedrock guardrails configured in this region

Configure guardrail sensitive-information filters for PII entities and custom sensitive-data patterns.

Agentic AI security domain: Prompt & Input Protection. Grounding checks reduce the chance that an agent acts on hallucinated or irrelevant context. Source check BR-27: No Bedrock guardrails configured in this region

Enable contextual grounding checks on guardrails for RAG and tool-using agent workflows.

Agentic AI security domain: Guardrail Enforcement. Bedrock agents should have guardrails associated so autonomous interactions are filtered consistently. Source check BR-28: No Bedrock agents configured in this region

Associate an approved Bedrock guardrail with each Bedrock agent and prepare the agent after updating.

Agentic AI security domain: Bounded Autonomy. Long-lived idle sessions widen the window for session reuse and unintended continuation of agent context. Source check BR-29: No Bedrock agents configured in this region

Set a conservative idleSessionTTLInSeconds value for agents based on application session requirements.

Agentic AI security domain: Abuse & Cost Protection. CloudWatch alarms help detect anomalous invocation errors, throttling, or volume caused by autonomous workflows. Source check BR-32: No CloudWatch alarms are configured on Amazon Bedrock runtime metrics (AWS/Bedrock namespace). Without alarms, abuse, denial-of-wallet, sustained throttling, and content-filter spikes can go undetected.

Configure CloudWatch alarms for Bedrock invocation errors, throttles, latency, and token or request volume where metrics are available.

Agentic AI security domain: Prompt & Input Protection. Agents should prevent prompt attacks before untrusted input can redirect planning or tool use. Source check BR-34: No Bedrock guardrails configured in this region

Enable a preventive PROMPT_ATTACK input filter on each guardrail and use Standard tier where prompt-leakage protection is required.

No regional Bedrock resources found to assess private connectivity

No action required

No regional Bedrock resources found to monitor with invocation logging

No action required

No regional Bedrock resources found to protect with guardrails

No action required

No regional Bedrock resources found to audit with Bedrock-specific CloudTrail coverage

No action required

Prompt Management feature is not being used. This may lead to inconsistent prompt handling and suboptimal model responses.

Implement Prompt Management to: 1. Create and version your prompts 2. Test different prompt variants 3. Share prompts across your organization 4. Maintain consistent prompt templates

No Bedrock agents found in the account

No action required

No Knowledge Bases found in the account

No action required

No guardrails configured - IAM enforcement check not applicable

Configure Bedrock Guardrails first, then enforce their use via IAM policies

Custom model API not available in us-east-2

Verify permissions to access Bedrock custom models

Model invocation logging to S3 is not configured

If logging is enabled to CloudWatch only, ensure CloudWatch log group uses CMK encryption

No Bedrock Flows found in the account

No action required

No Bedrock guardrails configured in this region

Create Bedrock guardrails with Standard tier for enhanced content filtering and protection

Could not assess this check in us-east-2. Assessment error: UnknownOperationException.

No action required on the assessed workload. Resolve the assessment prerequisite or permission issue and rerun the assessment.

No regional Bedrock resources found to assess with model evaluation jobs

No action required

No Bedrock prompt flows configured in this region

When creating prompt flows, use the ValidateFlowDefinition API to validate flow definitions before deployment

No Bedrock knowledge bases found in this region

When creating knowledge bases, specify customer-managed KMS keys for both vector store and data source encryption

No Bedrock agents configured in this region

When creating agents with action groups, ensure Lambda execution roles follow least privilege principles

No regional Bedrock resources found to assess model invocation throttling quotas

No action required

No Bedrock guardrails configured in this region

Create guardrails with all harmful-content filters enabled.

No Bedrock guardrails configured in this region

Create guardrails with Automated Reasoning policies for formal verification of model responses

No Bedrock knowledge bases found in this region

When implementing RAG applications, configure evaluation jobs to assess context relevance, response correctness, and prevent hallucinations

No Bedrock guardrails configured in this region

Create guardrails with sensitive-information filters (PII entities and/or regex patterns) to detect and redact sensitive data in prompts and model responses

No Bedrock guardrails configured in this region

Create guardrails with contextual grounding checks to detect hallucinations (ungrounded responses) and irrelevant answers, especially for RAG applications

No Bedrock agents configured in this region

When creating agents, associate a Bedrock guardrail so agent inputs and responses are filtered for harmful content, PII, and denied topics

No Bedrock agents configured in this region

When creating agents, set a conservative idleSessionTTLInSeconds to limit how long an idle session remains resumable

No imported custom Bedrock models found in this region

When importing models, specify a customer-managed KMS key for encryption to maintain control over encryption keys

No Bedrock batch inference (model invocation) jobs found in this region

When creating batch inference jobs, set outputDataConfig.s3OutputDataConfig.s3EncryptionKeyId to a customer-managed KMS key to encrypt the job output

No regional Bedrock resources found to monitor with CloudWatch alarms

No action required

No Lambda functions with Bedrock indicators were found in us-east-2; Inspector Lambda code-scanning coverage was not assessed for Bedrock-calling Lambda workloads.

No action required. If Bedrock-calling Lambda functions exist, ensure their function name, ARN, description, handler, role, or environment variables contain a Bedrock identifier that the assessment can detect, or evaluate Inspector coverage manually.

No Bedrock guardrails configured in this region

Create guardrails with a preventive PROMPT_ATTACK filter.

No Bedrock guardrails configured in this region

No action required

No application inference profiles found

No action required

Bedrock account data retention is inherit; this does not establish an explicit account-level zero-data-retention setting.

Set the account data-retention mode to none.