c1.11 Isolate AI workloads across accounts with guardrails

Contain blast radius with account boundaries

The strongest isolation boundary in AWS is the account. Separating development, inference/production, and model training/customization into distinct accounts (grouped into OUs) means a compromise or misconfiguration in one does not reach the others. AWS Organizations then lets you set service control policies (SCPs) — organization-wide guardrails that cap the maximum permissions any principal in an account can have, no matter how permissive their IAM policy is.

An SCP does not grant access; it sets the ceiling. You still grant day-to-day permissions with IAM.

Restrict which models can be used, org-wide

A common guardrail is to deny access to any foundation model except the ones your organization has approved and risk-assessed. The AWS-documented pattern uses NotResource so everything except the listed model ARNs is denied:

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Sid": "DenyUnapprovedBedrockModels",
      "Effect": "Deny",
      "Action": [
        "bedrock:InvokeModel",
        "bedrock:InvokeModelWithResponseStream"
      ],
      "NotResource": [
        "arn:aws:bedrock:*::foundation-model/anthropic.claude-3-5-sonnet-20240620-v1:0",
        "arn:aws:bedrock:*::foundation-model/amazon.titan-embed-text-v2:0"
      ]
    }
  ]
}

Keep inference inside approved Regions

Pair the model restriction with a Regional guardrail so Bedrock can only be called in Regions you have approved for data-residency reasons:

{
  "Sid": "RestrictBedrockToApprovedRegions",
  "Effect": "Deny",
  "Action": "bedrock:*",
  "Resource": "*",
  "Condition": {
    "StringNotEquals": {
      "aws:RequestedRegion": ["us-east-1", "us-west-2"]
    }
  }
}

Add a Config baseline

SCPs set the permission ceiling; AWS Config confirms the reality. Deploy a Config baseline (ideally via a conformance pack across the OU) to detect drift — a Bedrock resource created without encryption, invocation logging turned off, or a guardrail removed — and alert or auto-remediate.

Note: SCPs never apply to the management account, and they only constrain — they cannot grant. Test a new SCP on a single OU before rolling it org-wide, since an over-broad Deny can lock out legitimate workloads.