AI Security Maturity Model·AWS v1.0.0

Drag to explore · pinch to zoom
Home / Matrix / Capability 1 / c1.8
Enhanced Data ProtectionDefense-in-depth layer: Identity & Data Capability 1 · Model inferenceUse case: AI that answers 👤 CustomerAWS Shared Responsibility Model: who implements and operates this control. Customer = you own it; AWS = AWS operates it and you inherit it; Shared = both have obligations.

c1.8 Detect and redact PII in prompts and responses

Add real-time PII detection and redaction on model inputs and outputs so sensitive personal data is not sent to or returned by the model unnecessarily.

Foundational
Enhanced
Advanced
Effort: Medium Impact: High GenAI scopesFrom the AWS Generative AI Security Scoping Matrix.: 3 · Pre-trained models

Implementation guidance

How to implement on AWS

Apply Amazon Comprehend PII detection or Bedrock Guardrails PII filters to inputs and outputs, redacting in real time for interactive apps and in batch for stored conversations. Use Macie to find sensitive data in prompt/response stores. Alarm when PII detection exceeds baseline.

Acceptance criteria

PII is redacted on inference I/O; Macie scans prompt/log buckets; CloudWatch alarms on abnormal PII rates.

Practical implementation

How this control is implemented in each reference architecture:

PII is redacted inline in the Generative AI account via guardrail/Comprehend, and Macie scans the prompt/response stores for anything that slipped through.

  1. Enable Bedrock Guardrails PII filters (or an Amazon Comprehend PII step) on inputs and outputs in the Generative AI account, redacting in real time for interactive flows.
    Generative AI account Amazon Comprehend Amazon Bedrock
  2. Run Amazon Macie against the S3 buckets that store prompts, responses, and logs to discover residual sensitive data.
    Generative AI account Amazon Macie Amazon S3
  3. Alarm in CloudWatch when PII detection or redaction rates exceed baseline, and route Macie findings to Security Hub.
    Generative AI account → Security tooling CloudWatch Security Hub

How to validate: A PII sample in a prompt is redacted on I/O; Macie reports on the prompt/log buckets; a spike in PII detection raises an alarm.

Avoid: Storing raw prompts and completions unredacted 'for debugging'. Redact inline and scan the stores; unmanaged PII in logs is a breach waiting to happen.

Generative AI OU (multi-account) →

Inline PII redaction on model I/O plus a Macie scan of the in-account prompt/log buckets keeps personal data from accumulating.

  1. Turn on Bedrock Guardrails PII filters or a Comprehend PII detection step on inputs and outputs in the generative AI tier.
    Generative AI tier (IAM role) Amazon Comprehend Amazon Bedrock
  2. Point Amazon Macie at the buckets holding prompts, responses, and logs to find sensitive data that was not redacted.
    In-account logging Amazon Macie Amazon S3
  3. Alarm on abnormal PII rates in CloudWatch.
    In-account logging CloudWatch

How to validate: PII is redacted on inference I/O; Macie scans the prompt/log buckets; CloudWatch alarms on abnormal PII rates.

Avoid: Assuming users will not paste PII. Detect and redact it on every request and response, and scan where prompts land.

Single account (entry point) →

Threats addressed

  • Users pasting PII into prompts; models echoing PII in responses.
  • Privacy/compliance violations from unmanaged personal data.

AWS services

Amazon Comprehend Amazon Bedrock Guardrails Amazon Macie

Framework mappings

OWASP GenAI/LLM Top 10 (2026)

  • LLM02 Sensitive Information Disclosure

NIST AI Risk Management Framework (AI 100-1)

  • MAP.4 Risks and impacts are mapped
  • MANAGE.1 AI risks are prioritized, responded to and managed

AWS Well-Architected Generative AI Lens (Security)

  • GENSEC01-BP03 Implement least privilege access to data stores

Learning resources

References

  • AWS SRA for AI — Capability 1, Data security