c2.8 Secure the model promotion workflow across accounts
Move models through development, training, and inference accounts with scanning and approvals at each stage, so only validated artifacts reach production.
Implementation guidance
How to implement on AWS
Build the promotion workflow as a pipeline (e.g. AWS CodePipeline) that moves models dev → train → inference with automated artifact scanning and explicit manual-approval gates at each stage. Keep each environment in a separate account, store approved artifacts in a controlled Amazon S3 bucket with audited cross-account access, and record every promotion.
Acceptance criteria
Models pass automated scanning and documented approval before production; promotions are audited; each environment is a separate account.
Practical implementation
How this control is implemented in each reference architecture:
A CodePipeline promotion flow moves models dev → train → inference across separate accounts of the OU, with artifact scanning and manual-approval gates at each stage.
- Build the promotion pipeline with AWS CodePipeline that moves the model artifact dev → train → inference, each stage in a separate account of the Generative AI OU.Generative AI OU
CodePipeline 
AWS Organizations - Add automated artifact scanning and an explicit manual-approval gate before each promotion, storing approved artifacts in a controlled S3 bucket with audited cross-account access.Generative AI OU CodePipeline
Amazon S3 - Record every promotion (who approved, what hash) and forward the trail to the Log archive.Generative AI account → Log archive
CloudTrail Amazon S3
How to validate: Models pass scanning and a documented approval before production; each environment is a separate account; every promotion is audited.
Avoid: Copying a model straight into the inference account by hand. Without scanning and approval gates, an unvalidated or tampered artifact can reach production.
Approximate the promotion flow with pipeline stages and approvals inside the account; account-level separation of dev/train/inference is the reason to graduate.
- Use a CodePipeline with distinct dev/staging/prod stages (separated by roles, tags, and prefixes) and automated artifact scanning inside the account.Generative AI tier (IAM role) CodePipeline Amazon S3
- Require a manual-approval gate and store approved artifacts in a controlled bucket before the prod stage can consume them.Application tier (IAM role) CodePipeline
IAM - Plan graduation to a multi-account OU so dev/train/inference become separate accounts; log every promotion in the meantime.Generative AI OU (target state) AWS Organizations CloudTrail
How to validate: Promotions pass scanning and approval; artifacts are controlled; a documented plan exists to move to per-environment accounts.
Avoid: Training and serving from the same mutable location with no gate. Add scanning and approval now, and graduate to account-level separation for production.
Threats addressed
- Unvalidated or tampered models promoted straight to production.
- No approval trail for what model was deployed.
AWS services
AWS CodePipeline Amazon S3 AWS Organizations Framework mappings
OWASP GenAI/LLM Top 10 (2026)
- LLM04 Supply Chain
- LLM05 Data and Model Poisoning
NIST AI Risk Management Framework (AI 100-1)
- GOVERN.1 Policies, processes, procedures and accountability structures
- GOVERN.6 Policies for third-party software, data and supply chain risk
- MANAGE.3 Third-party risks and benefits are managed
AWS Well-Architected Generative AI Lens (Security)
- GENSEC01-BP01 Grant least privilege access to foundation model endpoints
Learning resources
References
- AWS SRA for AI — Capability 2, Multi-account training account