AI Security Maturity Model·AWS v1.0.0

Drag to explore · pinch to zoom
Home / Matrix / Capability 3 / c3.7
Enhanced AI Application SecurityDefense-in-depth layer: AI Application Capability 3 · Retrieval-augmented generation (RAG)Use case: AI that connects 👤 CustomerAWS Shared Responsibility Model: who implements and operates this control. Customer = you own it; AWS = AWS operates it and you inherit it; Shared = both have obligations.

c3.7 Secure the vector store and embedding integrity

Authenticate and authorize access to the vector store, encrypt it with a CMK, and control who can write embeddings, so the retrieval layer cannot be poisoned or read by unauthorized callers.

Foundational
Enhanced
Advanced
Effort: Medium Impact: High GenAI scopesFrom the AWS Generative AI Security Scoping Matrix.: 3 · Pre-trained models; 4 · Fine-tuned models

Implementation guidance

How to implement on AWS

Apply least-privilege data-access control on the OpenSearch Serverless collection, encrypt it server-side with a customer managed KMS key, and restrict which roles can write embeddings. Perform authorization at the generative AI application layer.

Acceptance criteria

The vector store enforces least-privilege data access; it is encrypted with a customer managed key; only approved roles can write embeddings.

Practical implementation

How this control is implemented in each reference architecture:

The OpenSearch Serverless collection enforces least-privilege data access, is CMK-encrypted, and only the ingestion role can write embeddings — read and write are split.

  1. Apply least-privilege data-access policies on the collection so the read (retrieval) role and the write (ingestion) role are separate and minimal.
    Generative AI account OpenSearch Service IAM
  2. Encrypt the collection server-side with the customer managed KMS key.
    Generative AI account AWS KMS OpenSearch Service
  3. Perform authorization at the generative AI application layer so callers cannot write embeddings directly.
    Generative AI account IAM

How to validate: The collection enforces least-privilege data access; it is CMK-encrypted; only the ingestion role can write embeddings; a retrieval-only role cannot modify the index.

Avoid: One role that both reads and writes the vector index. Split read from write so a compromised query path cannot poison the embeddings.

Generative AI OU (multi-account) →

Least-privilege data access on the collection, CMK encryption, and separate read/write roles keep the vector store from being poisoned or read by unauthorized callers.

  1. Set least-privilege data-access policies splitting the retrieval role from the ingestion (write) role.
    Generative AI tier (IAM role) OpenSearch Service IAM
  2. Encrypt the collection with the customer managed key.
    Generative AI tier (IAM role) AWS KMS OpenSearch Service
  3. Authorize at the application layer so only the ingestion path can write embeddings.
    Application tier (IAM role) IAM

How to validate: The collection enforces least-privilege access; it is CMK-encrypted; only the ingestion role writes embeddings.

Avoid: Letting the retrieval path write to the index. Separate read and write so retrieval cannot alter what future queries return.

Single account (entry point) →

Threats addressed

  • Tampering with embeddings or the vector index to manipulate retrieval.
  • Unauthorized read/write access to the vector store.

AWS services

Amazon OpenSearch Serverless AWS KMS AWS IAM

Framework mappings

OWASP GenAI/LLM Top 10 (2026)

  • LLM09 Vector and Embedding Weaknesses

NIST AI Risk Management Framework (AI 100-1)

  • MANAGE.1 AI risks are prioritized, responded to and managed

AWS Well-Architected Generative AI Lens (Security)

  • GENSEC01-BP03 Implement least privilege access to data stores

Learning resources

References

  • AWS SRA for AI — Capability 3, Amazon OpenSearch Serverless