Data security and privacy

Keep traffic private. An interface VPC endpoint (AWS PrivateLink) for Bedrock lets workloads in a VPC call it without going over the public internet; a gateway endpoint does the same for S3. Endpoint policies and IAM conditions such as aws:SourceVpce can make sure calls only come through that endpoint.

Grant least privilege. IAM policies can allow bedrock:InvokeModel on specific model or inference profile ARNs only, and service control policies in AWS Organizations can block whole model families across accounts. Give each Lambda function, agent and knowledge base its own role with just what it needs. Amazon Cognito and IAM Identity Center bring users in from an enterprise identity provider, so access can follow their groups.

Encrypt. Data is encrypted in transit with TLS and at rest; use AWS KMS customer managed keys where you need control over the keys, such as for custom models, knowledge base data, agent sessions and logs. Keep API keys for other providers in AWS Secrets Manager, not in code or environment variables.

Know what happens to your data. AWS says Bedrock doesn't use your prompts and completions to train AWS models and doesn't share them with third-party model providers. Model invocation logging is off until you turn it on; when on, it writes full requests and responses to S3 or CloudWatch Logs, so treat those logs as sensitive data too.

Find and protect personal information. Amazon Macie scans S3 buckets for sensitive data, which is how you find PII in documents before they go into a knowledge base. Amazon Comprehend detects PII in text in your pipeline so you can redact it, and a guardrail's sensitive information filter masks PII in prompts and replies. Data masking and anonymization (replace names with placeholders, drop exact dates) keep data useful without exposing people.

Control access to the data itself. AWS Lake Formation gives fine-grained permissions on data lake tables down to columns and rows. In RAG, filter retrieval by the user's permissions (metadata filters on access level or group) so the model never sees documents the user couldn't open. Set retention with S3 Lifecycle rules that expire old logs and transcripts, and watch access with CloudWatch and CloudTrail.