AI Security Maturity Model·AWS v1.0.0

Drag to explore · pinch to zoom
Home / Matrix / Capability 1 / c1.5
Foundational Identity and Access ManagementDefense-in-depth layer: Identity & Data Capability 1 · Model inferenceUse case: AI that answers 👤 CustomerAWS Shared Responsibility Model: who implements and operates this control. Customer = you own it; AWS = AWS operates it and you inherit it; Shared = both have obligations.

c1.5 Authenticate users before they reach the model

Require authenticated, authorized user identity in front of AI features so unauthenticated callers never reach model endpoints.

Foundational
Enhanced
Advanced
Effort: Medium Impact: High GenAI scopesFrom the AWS Generative AI Security Scoping Matrix.: 3 · Pre-trained models

Implementation guidance

How to implement on AWS

Use Amazon Cognito or AWS IAM Identity Center to authenticate end users and enforce MFA, then map users to fine-grained permissions that control which models and features they can reach.

Acceptance criteria

AI features require authentication; MFA is enforced for privileged access; user-to-model permissions are role-based and reviewed.

Practical implementation

How this control is implemented in each reference architecture:

Authentication happens at the Application account edge; only authenticated, authorized identities reach the code that assumes the invoke role into the Generative AI account.

  1. Put Amazon Cognito (customer-facing) or IAM Identity Center (workforce) in front of the AI features in the Application account, and enforce MFA for privileged users.
    Application account Amazon Cognito IAM Identity Center
  2. Map authenticated identities to fine-grained authorization (groups/scopes) that decide which AI features and models each user can reach before any cross-account call.
    Application account Amazon Cognito IAM
  3. Only after successful authentication does the application role assume the invoke-only role into the Generative AI account, so unauthenticated callers never reach the model.
    Application account → Generative AI account IAM

How to validate: Unauthenticated requests to AI features are rejected at the edge; MFA is required for privileged access; the invoke role can only be assumed by the authenticated application path.

Avoid: Exposing the model-invocation endpoint directly and relying on 'nobody knows the URL'. Authenticate and authorize at the app edge before any model call.

Generative AI OU (multi-account) →

A Cognito or IAM Identity Center front door authenticates users before the application tier assumes the model-invocation role — no anonymous path to the model.

  1. Add Amazon Cognito or IAM Identity Center authentication in front of the application tier and enforce MFA for privileged access.
    Application tier (IAM role) Amazon Cognito IAM Identity Center
  2. Authorize authenticated users to specific features/models with groups or scopes, checked before the app assumes the model-invocation role.
    Application tier (IAM role) Amazon Cognito IAM
  3. Ensure the generative AI tier role can only be assumed by the authenticated application path, not by arbitrary principals in the account.
    Generative AI tier (IAM role) IAM

How to validate: AI features require authentication; MFA is enforced for privileged users; the model-invocation role's trust policy admits only the app path.

Avoid: Wiring the UI straight to Bedrock with a static key. Front the model with authentication and per-user authorization even in a single account.

Single account (entry point) →

Threats addressed

  • Anonymous or unauthenticated access to model endpoints.
  • Inability to attribute an inference request to a user.

AWS services

Amazon Cognito AWS IAM Identity Center

Framework mappings

OWASP GenAI/LLM Top 10 (2026)

  • LLM02 Sensitive Information Disclosure

NIST AI Risk Management Framework (AI 100-1)

  • MANAGE.1 AI risks are prioritized, responded to and managed

AWS Well-Architected Generative AI Lens (Security)

  • GENSEC01-BP01 Grant least privilege access to foundation model endpoints

Learning resources

References

  • AWS SRA for AI — Capability 1, AI inference account