AI Security Maturity Model·AWS v1.0.0

Drag to explore · pinch to zoom
Home / Matrix / Capability 3 / c3.5
Enhanced Data ProtectionDefense-in-depth layer: Identity & Data Capability 3 · Retrieval-augmented generation (RAG)Use case: AI that connects 👤 CustomerAWS Shared Responsibility Model: who implements and operates this control. Customer = you own it; AWS = AWS operates it and you inherit it; Shared = both have obligations.

c3.5 Classify and tag data at ingestion

Classify RAG source data by sensitivity at the point of ingestion and tag it, so downstream controls (metadata filtering, access, retention) can enforce the right handling.

Foundational
Enhanced
Advanced
Effort: Medium Impact: Medium GenAI scopesFrom the AWS Generative AI Security Scoping Matrix.: 3 · Pre-trained models; 4 · Fine-tuned models

Implementation guidance

How to implement on AWS

Define classification tiers (public, internal, confidential, restricted). Use Amazon Macie to detect and classify sensitive data at ingestion, apply AWS resource tags (enforced by Organizations tag policies), and maintain a data catalog in AWS Glue mapping location, sensitivity, and controls.

Acceptance criteria

Source data is classified and tagged at ingestion; a data catalog records sensitivity and controls; tag policies enforce standards.

Practical implementation

How this control is implemented in each reference architecture:

Source data is classified by Macie at ingestion, tagged (enforced by org tag policies), and cataloged in Glue so downstream controls know how to handle it.

  1. Define classification tiers (public, internal, confidential, restricted) and use Amazon Macie to detect and classify sensitive data as it is ingested in the Generative AI account.
    Generative AI account Amazon Macie Amazon S3
  2. Apply AWS resource tags for sensitivity and enforce them with Organizations tag policies at the OU level.
    Generative AI OU (guardrail) AWS Organizations Amazon S3
  3. Maintain an AWS Glue Data Catalog mapping location, sensitivity, and required controls for each dataset.
    Generative AI account AWS Glue

How to validate: Source data is classified and tagged at ingestion; the Glue catalog records sensitivity and controls; tag policies enforce the tagging standard.

Avoid: Treating all RAG data as one bucket of 'internal' content. Classify at ingestion so metadata filtering, access, and retention can act on real sensitivity.

Generative AI OU (multi-account) →

Macie classifies source data at ingestion, tags carry sensitivity, and a Glue catalog records handling — all within the account.

  1. Define classification tiers and use Amazon Macie to classify sensitive data at ingestion.
    Generative AI tier (IAM role) Amazon Macie Amazon S3
  2. Apply sensitivity tags to the source data and keep a consistent tagging convention.
    Generative AI tier (IAM role) Amazon S3
  3. Maintain a Glue Data Catalog mapping location, sensitivity, and controls.
    Generative AI tier (IAM role) AWS Glue

How to validate: Data is classified and tagged at ingestion; the catalog records sensitivity and controls.

Avoid: Skipping classification and hoping filters catch everything. Classify and tag first so the rest of the controls have something to enforce against.

Single account (entry point) →

Threats addressed

  • The AI treating all data the same because nothing is classified.
  • Sensitive data handled without the controls its classification requires.

AWS services

Amazon Macie AWS Glue Data Catalog AWS Organizations

Framework mappings

OWASP GenAI/LLM Top 10 (2026)

  • LLM02 Sensitive Information Disclosure
  • LLM08 Hidden Context Exposure

NIST AI Risk Management Framework (AI 100-1)

  • MAP.4 Risks and impacts are mapped
  • MAP.5 Impacts to individuals, groups and society are characterized

AWS Well-Architected Generative AI Lens (Security)

  • GENSEC01-BP03 Implement least privilege access to data stores

Learning resources

References

  • AWS SRA for AI — Capability 3, Data classification and handling