AI Security Maturity Model·AWS v1.0.0

Drag to explore · pinch to zoom
Home / Matrix / Capability 3 / c3.8
Advanced Logging and MonitoringDefense-in-depth layer: AI Application Capability 3 · Retrieval-augmented generation (RAG)Use case: AI that connects 👤 CustomerAWS Shared Responsibility Model: who implements and operates this control. Customer = you own it; AWS = AWS operates it and you inherit it; Shared = both have obligations.

c3.8 Track data lineage and provenance across the RAG pipeline

Record where RAG data came from and how it was transformed, so you can audit handling, investigate incidents, and analyze the impact of data changes.

Foundational
Enhanced
Advanced
Effort: High Impact: Medium GenAI scopesFrom the AWS Generative AI Security Scoping Matrix.: 3 · Pre-trained models; 4 · Fine-tuned models

Implementation guidance

How to implement on AWS

Track lineage with AWS Glue Data Catalog across data-processing pipelines, capture API activity with CloudTrail, and monitor data quality and drift with CloudWatch. Maintain provenance from source through ingestion to retrieval.

Acceptance criteria

Lineage is recorded from source to vector store; CloudTrail captures RAG API activity; provenance supports audits and incident analysis.

Practical implementation

How this control is implemented in each reference architecture:

Glue Data Catalog tracks lineage across the RAG pipeline, CloudTrail (to the Log archive) captures API activity, and CloudWatch watches data quality/drift.

  1. Track lineage with AWS Glue Data Catalog across the data-processing pipeline from source through ingestion to the vector store.
    Generative AI account AWS Glue Amazon S3
  2. Capture RAG API activity with CloudTrail and forward it to the central Log archive for tamper-resistant retention.
    Generative AI account → Log archive CloudTrail Amazon S3
  3. Monitor data quality and drift with CloudWatch and alarm on anomalies.
    Generative AI account CloudWatch

How to validate: Lineage is recorded from source to vector store; CloudTrail captures RAG API activity in the Log archive; provenance supports an audit or incident query.

Avoid: No record of where a retrieved fact came from. When a bad answer surfaces you cannot trace it; keep lineage from source to retrieval.

Generative AI OU (multi-account) →

Glue lineage, CloudTrail (to an in-account Object-Lock bucket), and CloudWatch drift monitoring give provenance from source to retrieval.

  1. Track lineage with AWS Glue Data Catalog across the RAG pipeline.
    Generative AI tier (IAM role) AWS Glue Amazon S3
  2. Capture RAG API activity with CloudTrail into the in-account Object-Lock log bucket.
    In-account logging CloudTrail Amazon S3
  3. Monitor data quality and drift with CloudWatch.
    In-account logging CloudWatch

How to validate: Lineage is recorded source-to-store; CloudTrail captures RAG activity; provenance supports audits.

Avoid: Treating the RAG store as a black box. Track provenance so you can investigate a poisoned or wrong answer.

Single account (entry point) →

Threats addressed

  • No audit trail of data origin and transformations during an investigation.
  • Unknown downstream impact when source data changes.

AWS services

AWS Glue Data Catalog AWS CloudTrail Amazon CloudWatch

Framework mappings

OWASP GenAI/LLM Top 10 (2026)

  • LLM08 Hidden Context Exposure

NIST AI Risk Management Framework (AI 100-1)

  • MAP.2 AI system categorization and capabilities are documented
  • MEASURE.3 Mechanisms for tracking AI risks are in place

AWS Well-Architected Generative AI Lens (Security)

  • GENSEC03-BP01 Implement control plane and data access monitoring

Learning resources

References

  • AWS SRA for AI — Capability 3, Data lineage and provenance tracking