AI Security Maturity Model·AWS v1.0.0

Drag to explore · pinch to zoom
Home / Matrix / Capability 4 / c4.3
Foundational Data ProtectionDefense-in-depth layer: Identity & Data Capability 4 · ToolsUse case: AI that acts 🤝 SharedAWS Shared Responsibility Model: who implements and operates this control. Customer = you own it; AWS = AWS operates it and you inherit it; Shared = both have obligations.

c4.3 Encrypt tool I/O and isolate tool sessions

Encrypt tool inputs, outputs, and execution context, and run each tool session in an isolated environment so state cannot leak between executions.

Foundational
Enhanced
Advanced
Effort: Low Impact: High GenAI scopesFrom the AWS Generative AI Security Scoping Matrix.: 3 · Pre-trained models; 4 · Fine-tuned models Agentic security dimensionsFrom the AWS Agentic AI Security Scoping Matrix.: Memory & state

Implementation guidance

How to implement on AWS

Run tools on Amazon Bedrock AgentCore Runtime, whose dedicated microVMs isolate each session's CPU, memory, and file system and purge state on termination. Configure a customer managed KMS key for session data and require TLS 1.2+/AES-256 for all tool communications.

Acceptance criteria

Each session runs in an isolated microVM and purges state on completion; session data uses a customer managed key; tool traffic is TLS 1.2+.

Practical implementation

How this control is implemented in each reference architecture:

Tools run on AgentCore Runtime microVMs in the Generative AI account that isolate each session and purge state on termination, with session data CMK-encrypted and TLS in transit.

  1. Run tools on Amazon Bedrock AgentCore Runtime so each session gets a dedicated microVM isolating CPU, memory, and file system, with state purged on termination.
    Generative AI account AgentCore Runtime
  2. Configure a customer managed KMS key for session data and require TLS 1.2+/AES-256 for all tool communications.
    Generative AI account AWS KMS
  3. Confirm no shared scratch space or cache persists across sessions.
    Generative AI account Amazon Bedrock

How to validate: Each session runs in an isolated microVM and purges state on completion; session data uses the customer managed key; tool traffic is TLS 1.2+.

Avoid: Reusing one long-lived execution environment across users. Session state then leaks between users; isolate per session and purge on exit.

Generative AI OU (multi-account) →

AgentCore Runtime microVMs isolate each tool session in the account and purge state on exit, with CMK-encrypted session data and TLS in transit.

  1. Run tools on AgentCore Runtime so each session is an isolated microVM that purges state on termination.
    Generative AI tier (IAM role) AgentCore Runtime
  2. Set a customer managed KMS key for session data and enforce TLS 1.2+/AES-256 on tool communications.
    Generative AI tier (IAM role) AWS KMS
  3. Verify no cache or scratch space persists between sessions.
    Generative AI tier (IAM role) Amazon Bedrock

How to validate: Each session runs isolated and purges state; session data is CMK-encrypted; tool traffic is TLS 1.2+.

Avoid: Letting tools share a filesystem or memory across sessions. Isolate each session so one user's data cannot leak into another's tool run.

Single account (entry point) →

Threats addressed

  • Data leakage between tool executions or user sessions.
  • Tool inputs/outputs readable in transit or at rest.

AWS services

Amazon Bedrock AgentCore Runtime AWS KMS

Framework mappings

OWASP GenAI/LLM Top 10 (2026)

  • LLM02 Sensitive Information Disclosure

NIST AI Risk Management Framework (AI 100-1)

  • MANAGE.1 AI risks are prioritized, responded to and managed

AWS Security Hub — AI Security Best Practices

  • BedrockAgentCore.4 Bedrock AgentCore Gateway should be encrypted with customer managed AWS KMS keys

AWS Well-Architected Generative AI Lens (Security)

  • GENSEC01-BP03 Implement least privilege access to data stores

OWASP GenAI Top 10 for Agentic Applications (2025)

  • ASI06 Memory and Context Poisoning

Watch

AWS video: a short introduction to Amazon Bedrock AgentCore — an overview of the managed service for securely deploying and operating AI agents, and the building blocks (identity, gateway, runtime, memory) used across the tool and agent controls in this capability.

Learning resources

References

  • AWS SRA for AI — Capability 4, Data protection