AWS AI Security Framework

aws_ai_security_framework_1.0_aws

AWS-AI-Security-Frameworkv1.0

OfficialVerified

Security compliance framework based on the AWS AI Security Framework blog post (2025). Organizes controls across three security layers (Infrastructure, Identity & Data, AI Application), three deployment phases (Foundational, Enhanced, Advanced), and three AI use cases (AI that Answers, AI that Connects, AI that Acts). Maps existing Prowler checks to AI workload security requirements and identifies gaps requiring new checks.

63requirements226checks

Prowler prowler-provider-aws

Run this compliance with Prowler

Run in Prowler Cloud

Run

prowler aws --compliance aws_ai_security_framework_1.0_aws

Requirements (63)

Infrastructure Security1286

AISF-INFRA-01Ensure VPC endpoints provide private connectivity for Bedrock APIs, preventing AI traffic from traversing the public internet.1

Attributes

Type: Automated
Section: Infrastructure Security
Service: bedrock
Sub Section: Network Isolation

AISF-INFRA-02Ensure VPCs have Network Firewall enabled to inspect and filter AI workload traffic, with logging, multi-AZ deployment, and proper default actions for both full and fragmented packets.7

Attributes

Type: Automated
Section: Infrastructure Security
Service: networkfirewall
Sub Section: Network Firewall

AISF-INFRA-03Ensure WAFv2 Web ACLs are configured with rules and logging to protect AI application endpoints from HTTP-based attacks including prompt injection patterns at the perimeter.5

Attributes

Type: Automated
Section: Infrastructure Security
Service: wafv2
Sub Section: Web Application Firewall

AISF-INFRA-04Ensure AWS Shield Advanced is enabled to protect internet-facing AI application infrastructure from DDoS attacks.6

Attributes

Type: Automated
Section: Infrastructure Security
Service: shield
Sub Section: DDoS Protection

AISF-INFRA-05Ensure all data at rest is encrypted with AES-256 across AI workload storage including S3 buckets, EBS volumes, RDS instances, SageMaker notebooks, and Bedrock prompts using customer-managed KMS keys where possible.16

Attributes

Type: Automated
Section: Infrastructure Security
Service: kms
Sub Section: Encryption at Rest

AISF-INFRA-06Ensure all data in transit uses TLS 1.2 or higher, including API communications, inter-container traffic for ML training, and connections between AI application components.9

Attributes

Type: Automated
Section: Infrastructure Security
Service: multiple
Sub Section: Encryption in Transit

AISF-INFRA-07Ensure customer-managed KMS keys are in use, rotation is enabled, and keys are not scheduled for unintentional deletion to maintain control over AI data encryption.4

Attributes

Type: Automated
Section: Infrastructure Security
Service: kms
Sub Section: Key Management

AISF-INFRA-08Ensure VPC endpoints enforce trust boundaries, subnets do not assign public IPs by default, and flow logs are enabled for all VPCs hosting AI workloads.7

Attributes

Type: Automated
Section: Infrastructure Security
Service: vpc
Sub Section: VPC Security

AISF-INFRA-09Ensure hardware-enforced compute isolation is in use for AI workloads. AWS Nitro System provides isolation with no operator access to customer data during model inference and training.4

Attributes

Type: Automated
Section: Infrastructure Security
Service: ec2
Sub Section: Compute Isolation

AISF-RUNTIME-01Ensure EKS clusters used for AI agent runtimes are properly secured with private endpoints, network policies, supported versions, control plane logging, and secrets encryption.9

Attributes

Type: Automated
Section: Infrastructure Security
Service: eks
Sub Section: Container Runtime Security

AISF-RUNTIME-02Ensure ECS tasks used for AI workloads have no public IPs, no privileged containers, read-only root filesystems, logging enabled, and no secrets in environment variables.9

Attributes

Type: Automated
Section: Infrastructure Security
Service: ecs
Sub Section: Container Runtime Security

AISF-RUNTIME-03Ensure Lambda functions used in AI architectures are deployed in VPCs, not publicly accessible, use supported runtimes, have no secrets in code or variables, and use CMK-encrypted environment variables.9

Attributes

Type: Automated
Section: Infrastructure Security
Service: awslambda
Sub Section: Serverless Runtime Security

Identity and Data Security1490

AISF-IAM-01Ensure MFA is enforced for all users accessing AI services, including root account hardware MFA, IAM user MFA for console access, and Cognito user pool MFA for AI application end users.9

Attributes

Type: Automated
Section: Identity and Data Security
Service: iam
Sub Section: Authentication

AISF-IAM-02Ensure least-privilege access is enforced for all AI service identities. No administrative privileges should be attached to IAM entities that interact with Bedrock, SageMaker, or other AI services.13

Attributes

Type: Automated
Section: Identity and Data Security
Service: iam
Sub Section: Authorization

AISF-IAM-03Ensure temporary and scoped credentials are used for AI service access. Long-term access keys should be avoided, rotated within 90 days when necessary, and unused keys should be disabled.8

Attributes

Type: Automated
Section: Identity and Data Security
Service: iam
Sub Section: Credential Management

AISF-IAM-04Ensure root account is properly secured with no active access keys and minimal usage, as root credentials in AI environments could grant unrestricted access to all AI models, data, and agent configurations.4

Attributes

Type: Automated
Section: Identity and Data Security
Service: iam
Sub Section: Root Account

AISF-IAM-05Ensure IAM roles used for AI services prevent cross-service confused deputy attacks and stale access to Bedrock and SageMaker is reviewed regularly.5

Attributes

Type: Automated
Section: Identity and Data Security
Service: iam
Sub Section: Service Roles

AISF-IAM-06Ensure strong password policies are enforced with minimum length, complexity requirements, expiration, and reuse prevention for all human identities accessing AI services.12

Attributes

Type: Automated
Section: Identity and Data Security
Service: iam
Sub Section: Password Policy

AISF-IAM-07Ensure Cognito user pools are properly configured for AI application user authentication with advanced security features, token revocation, self-registration controls, and WAF protection.9

Attributes

Type: Automated
Section: Identity and Data Security
Service: cognito
Sub Section: User Authentication

AISF-IAM-08Ensure API Gateway endpoints serving AI applications have proper authorization configured to authenticate and authorize every request to the model layer.3

Attributes

Type: Automated
Section: Identity and Data Security
Service: apigateway
Sub Section: API Authorization

AISF-DATA-01Ensure Amazon Macie is enabled with automated sensitive data discovery to classify and protect enterprise data before it is made available to AI systems through RAG or other patterns.2

Attributes

Type: Automated
Section: Identity and Data Security
Service: macie
Sub Section: Data Classification

AISF-DATA-02Ensure IAM Access Analyzer is enabled to validate access policies and identify unintended access to resources used by AI workloads.2

Attributes

Type: Automated
Section: Identity and Data Security
Service: accessanalyzer
Sub Section: Access Analysis

AISF-DATA-03Ensure Secrets Manager is used for AI application credentials with automatic rotation enabled, restrictive resource policies, and no public access.5

Attributes

Type: Automated
Section: Identity and Data Security
Service: secretsmanager
Sub Section: Secrets Management

AISF-DATA-04Ensure S3 buckets used for AI training data, model artifacts, RAG knowledge bases, and inference logs have public access blocked, encryption enabled, secure transport enforced, and access logging configured.11

Attributes

Type: Automated
Section: Identity and Data Security
Service: s3
Sub Section: Storage Security

AISF-DATA-05Ensure no secrets or credentials are hardcoded in Lambda functions, ECS task definitions, or EC2 instances used as part of AI application architectures.6

Attributes

Type: Automated
Section: Identity and Data Security
Service: multiple
Sub Section: Secret Hygiene

AISF-DATA-06Ensure the AWS Organization has opted out of all AI services data usage and child accounts cannot override this policy, preventing AWS from using customer data for AI service improvement.1

Attributes

Type: Automated
Section: Identity and Data Security
Service: organizations
Sub Section: Data Governance

AI Application Security2324

AISF-AI-01Ensure Amazon Bedrock has at least one guardrail configured to provide content filtering, prompt injection defense, PII filtering, and topic restrictions for foundation model interactions.1

Attributes

Type: Automated
Section: AI Application Security
Service: bedrock
Sub Section: Content Filtering

AISF-AI-02Ensure Bedrock guardrails have prompt attack filter strength set to HIGH to detect and block prompt injection attempts, the #1 risk in OWASP Top 10 for LLM Applications.1

Attributes

Type: Automated
Section: AI Application Security
Service: bedrock
Sub Section: Prompt Security

AISF-AI-03Ensure Bedrock guardrails block or mask sensitive information (PII) in both model inputs and outputs to prevent data leakage through AI responses.1

Attributes

Type: Automated
Section: AI Application Security
Service: bedrock
Sub Section: Output Filtering

AISF-AI-04Ensure all Bedrock agents have guardrails enabled to protect agent sessions from prompt injection, data exfiltration, and unauthorized actions during agentic workflows.1

Attributes

Type: Automated
Section: AI Application Security
Service: bedrock
Sub Section: Agent Security

AISF-AI-05Ensure Bedrock model invocation logging is enabled to maintain an immutable audit trail of all model interactions, enabling incident investigation and behavioral analysis.2

Attributes

Type: Automated
Section: AI Application Security
Service: bedrock
Sub Section: AI Audit Logging

AISF-AI-06Ensure CloudTrail is configured to log all Bedrock API calls for security auditing, enabling detection of unauthorized model access, configuration changes, and potential LLM jacking.1

Attributes

Type: Automated
Section: AI Application Security
Service: cloudtrail
Sub Section: AI Audit Logging

AISF-AI-07Ensure Bedrock prompts are encrypted at rest with customer-managed KMS keys and Prompt Management is used for centralized prompt governance.2

Attributes

Type: Automated
Section: AI Application Security
Service: bedrock
Sub Section: Prompt Management

AISF-AI-08Ensure Bedrock Automated Reasoning Checks are configured to provide formal verification of model responses against source documents, achieving up to 99% verification accuracy against hallucinations.0

Attributes

Type: Manual
Section: AI Application Security
Service: bedrock
Sub Section: Output Validation

AISF-AI-09Ensure Bedrock Contextual Grounding is configured to validate semantic consistency of model responses against sanctioned source documents, preventing hallucinated or fabricated outputs.1

Attributes

Type: Automated
Section: AI Application Security
Service: bedrock
Sub Section: Output Validation

AISF-AI-10Ensure Bedrock Knowledge Bases used for RAG patterns have proper security controls including encryption with customer-managed keys and VPC configuration for private data access.1

Attributes

Type: Automated
Section: AI Application Security
Service: bedrock
Sub Section: RAG Security

AISF-AI-11Ensure WAF AI Activity Dashboard is configured to monitor and analyze AI-specific traffic patterns, providing visibility into potential attacks targeting AI endpoints.0

Attributes

Type: Manual
Section: AI Application Security
Service: wafv2
Sub Section: AI Traffic Monitoring

AISF-AGENT-01Ensure every AI agent has its own identity with scoped credentials and independent authorization per request, following zero-trust principles. Agent identities must be separate from human user identities.1

Attributes

Type: Automated
Section: AI Application Security
Service: bedrock
Sub Section: Agent Governance

AISF-AGENT-02Ensure Bedrock AgentCore Cedar Policies enforce provable least-privilege authorization on every tool call and data access made by AI agents.0

Attributes

Type: Manual
Section: AI Application Security
Service: bedrock
Sub Section: Agent Governance

AISF-AGENT-03Ensure AI agents have behavioral monitoring and observability configured to detect scope violations, anomalous actions, and drift from expected behavior patterns.0

Attributes

Type: Manual
Section: AI Application Security
Service: bedrock
Sub Section: Agent Governance

AISF-AGENT-04Ensure a central agent registry exists to catalog all AI agents, their permissions, data access patterns, and operational boundaries for governance at scale.0

Attributes

Type: Manual
Section: AI Application Security
Service: bedrock
Sub Section: Agent Governance

AISF-AGENT-05Ensure human-in-the-loop approval is required for high-consequence agent actions such as financial transactions, data deletion, or privilege changes.0

Attributes

Type: Manual
Section: AI Application Security
Service: bedrock
Sub Section: Agent Governance

AISF-ML-01Ensure SageMaker models have network isolation enabled to prevent models from making unauthorized network calls during inference.2

Attributes

Type: Automated
Section: AI Application Security
Service: sagemaker
Sub Section: ML Platform Security

AISF-ML-02Ensure SageMaker notebook instances are secured with encryption, VPC settings, no direct internet access, and root access disabled.4

Attributes

Type: Automated
Section: AI Application Security
Service: sagemaker
Sub Section: ML Platform Security

AISF-ML-03Ensure SageMaker training jobs have network isolation, VPC configuration, inter-container traffic encryption, and volume encryption enabled to protect training data and model weights.4

Attributes

Type: Automated
Section: AI Application Security
Service: sagemaker
Sub Section: ML Platform Security

AISF-ML-04Ensure SageMaker Model Registry is in use with approved model packages and SSO authentication is configured for SageMaker domains.2

Attributes

Type: Automated
Section: AI Application Security
Service: sagemaker
Sub Section: ML Platform Security

AISF-ML-05Ensure SageMaker Model Monitor is configured for continuous model quality and bias monitoring, and SageMaker Clarify is used for bias detection in AI/ML workloads.0

Attributes

Type: Manual
Section: AI Application Security
Service: sagemaker
Sub Section: ML Platform Security

AISF-MODEL-01Perform security evaluation of foundation models before deployment, including assessment of input sanitization, access controls, bias audits, privacy disclosure, data poisoning resilience, adversarial resilience, and prompt injection defenses.0

Attributes

Type: Manual
Section: AI Application Security
Service: bedrock
Sub Section: Model Governance

AISF-MODEL-02Ensure model selection is appropriate for the use case with CISO involvement in evaluation. Customer-facing agents require different model security profiles than internal summarization tools.0

Attributes

Type: Manual
Section: AI Application Security
Service: bedrock
Sub Section: Model Governance

Threat Detection and Monitoring736

AISF-DETECT-01Ensure CloudTrail is enabled in all regions with multi-region logging, management event recording, log file validation, and CloudWatch integration for comprehensive AI workload audit trails.8

Attributes

Type: Automated
Section: Threat Detection and Monitoring
Service: cloudtrail
Sub Section: Audit Logging

AISF-DETECT-02Ensure GuardDuty is enabled across all regions with delegated admin, S3 protection, EKS monitoring, Lambda protection, and malware protection to detect AI-specific threat patterns.12

Attributes

Type: Automated
Section: Threat Detection and Monitoring
Service: guardduty
Sub Section: Threat Detection

AISF-DETECT-03Ensure CloudTrail-based threat detection is monitoring for LLM jacking, privilege escalation, and enumeration activity that could indicate attacks against AI infrastructure.5

Attributes

Type: Automated
Section: Threat Detection and Monitoring
Service: cloudtrail
Sub Section: AI Threat Detection

AISF-DETECT-04Ensure Security Hub is enabled with standards and integrations configured to aggregate and prioritize security findings across all AI workload services.1

Attributes

Type: Automated
Section: Threat Detection and Monitoring
Service: securityhub
Sub Section: Security Aggregation

AISF-DETECT-05Ensure CloudWatch metric filters and alarms are configured for critical security events including IAM policy changes, unauthorized API calls, console sign-in without MFA, KMS key deletion, and network changes.10

Attributes

Type: Automated
Section: Threat Detection and Monitoring
Service: cloudwatch
Sub Section: Security Alerting

AISF-DETECT-06Ensure Amazon Detective is enabled for AI security incident investigation, providing full decision chain reconstruction from prompt to data access to action.0

Attributes

Type: Manual
Section: Threat Detection and Monitoring
Service: detective
Sub Section: Incident Investigation

AISF-DETECT-07Ensure GuardDuty Extended Threat Detection is enabled for AI-specific patterns including anomalous Bedrock API usage, model access from unusual locations, and potential data exfiltration through AI channels.0

Attributes

Type: Manual
Section: Threat Detection and Monitoring
Service: guardduty
Sub Section: AI Threat Detection

Governance and Compliance79

AISF-GOV-01Ensure AWS Config recorder is enabled in all regions to continuously monitor and record AI resource configurations, detect drift, and enforce compliance rules.2

Attributes

Type: Automated
Section: Governance and Compliance
Service: config
Sub Section: Configuration Management

AISF-GOV-02Ensure the AWS account is part of an AWS Organization with proper governance controls including SCPs to restrict operations to approved regions and delegated administrators are trusted.4

Attributes

Type: Automated
Section: Governance and Compliance
Service: organizations
Sub Section: Account Governance

AISF-GOV-03Ensure security contact information is registered and current for AI workload incident response communication.3

Attributes

Type: Automated
Section: Governance and Compliance
Service: account
Sub Section: Incident Response

AISF-GOV-04Ensure AWS Control Tower is enabled with landing zone configured to automate account governance and enforce security baselines across all accounts hosting AI workloads.0

Attributes

Type: Manual
Section: Governance and Compliance
Service: controltower
Sub Section: Automated Governance

AISF-GOV-05Maintain an inventory of all AI workloads including approved and shadow AI usage. Document model selections, their governance requirements, and security evaluations.0

Attributes

Type: Manual
Section: Governance and Compliance
Service: multiple
Sub Section: AI Governance

AISF-GOV-06Ensure AI-specific threat models are developed before production deployment, covering prompt injection, jailbreaks, data exfiltration, model poisoning, and adversarial attacks.0

Attributes

Type: Manual
Section: Governance and Compliance
Service: multiple
Sub Section: AI Governance

AISF-GOV-07Ensure incident response plans include AI-specific scenarios covering prompt injection, model manipulation, data exfiltration through AI, LLM jacking, and agent scope violations.0

Attributes

Type: Manual
Section: Governance and Compliance
Service: multiple
Sub Section: Incident Response