AI Security Maturity Model·AWS v1.0.0

Drag to explore · pinch to zoom
Home / Matrix / Capability 3 / c3.4
Enhanced Data ProtectionDefense-in-depth layer: Identity & Data Capability 3 · Retrieval-augmented generation (RAG)Use case: AI that connects 👤 CustomerAWS Shared Responsibility Model: who implements and operates this control. Customer = you own it; AWS = AWS operates it and you inherit it; Shared = both have obligations.

c3.4 Validate and scan documents before ingestion

Scan and sanitize documents before they enter the knowledge base, so poisoned or malicious content cannot drive indirect prompt injection or leak sensitive data.

Foundational
Enhanced
Advanced
Effort: Medium Impact: High GenAI scopesFrom the AWS Generative AI Security Scoping Matrix.: 3 · Pre-trained models; 4 · Fine-tuned models

Implementation guidance

How to implement on AWS

Use GuardDuty Malware Protection for S3 to scan files before they become a data source. Use Amazon Comprehend to detect and redact PII in documents before indexing, and Amazon Macie to alert on sensitive data in the source buckets. Reject or quarantine documents that fail validation.

Acceptance criteria

Ingestion pipeline scans for malware and redacts PII before indexing; Macie alerts on sensitive source data; a poisoned/oversensitive document is quarantined.

Practical implementation

How this control is implemented in each reference architecture:

Documents are scanned for malware and PII-redacted before they become a data source in the Generative AI account; anything that fails is quarantined, never indexed.

  1. Run GuardDuty Malware Protection for S3 on the ingestion landing bucket so files are scanned before becoming a knowledge base source.
    Generative AI account GuardDuty Amazon S3
  2. Use Amazon Comprehend to detect and redact PII in documents before indexing, and Amazon Macie to alert on sensitive data in the source buckets.
    Generative AI account Amazon Comprehend Amazon Macie
  3. Quarantine (move to an isolated bucket, block indexing) any document that fails malware or sensitivity validation, and log the decision.
    Generative AI account AWS Lambda Amazon S3

How to validate: The ingestion pipeline scans malware and redacts PII before indexing; Macie alerts on sensitive source data; a poisoned or oversensitive test document is quarantined.

Avoid: Pointing the knowledge base straight at a raw bucket. Untrusted documents drive indirect prompt injection; scan and sanitize before indexing.

Generative AI OU (multi-account) →

An in-account ingestion pipeline scans and PII-redacts documents before indexing and quarantines anything that fails validation.

  1. Enable GuardDuty Malware Protection for S3 on the ingestion bucket to scan files before they become a source.
    Generative AI tier (IAM role) GuardDuty Amazon S3
  2. Detect and redact PII with Comprehend before indexing, and alert on sensitive source data with Macie.
    Generative AI tier (IAM role) Amazon Comprehend Amazon Macie
  3. Quarantine documents that fail validation and log the outcome.
    In-account logging AWS Lambda Amazon S3

How to validate: Ingestion scans malware and redacts PII before indexing; Macie alerts on sensitive data; a bad document is quarantined.

Avoid: Indexing whatever lands in the bucket. Validate and sanitize documents so the RAG store cannot be poisoned or leak sensitive data.

Single account (entry point) →

Threats addressed

  • Indirect prompt injection through malicious documents inserted into the knowledge base.
  • Sensitive data indexed into the RAG store.

AWS services

Amazon GuardDuty Amazon Comprehend Amazon Macie Amazon S3

Framework mappings

OWASP GenAI/LLM Top 10 (2026)

  • LLM01 Prompt Injection
  • LLM05 Data and Model Poisoning

NIST AI Risk Management Framework (AI 100-1)

  • MAP.4 Risks and impacts are mapped
  • MANAGE.1 AI risks are prioritized, responded to and managed

AWS Well-Architected Generative AI Lens (Security)

  • GENSEC06-BP01 Implement data purification filters for model training workflows

Learning resources

References

  • AWS SRA for AI — Capability 3, Input and output validation