AI Security Maturity Model·AWS v1.0.0

Drag to explore · pinch to zoom
Home / Matrix / Capability 5 / c5.2
Foundational Data ProtectionDefense-in-depth layer: Identity & Data Capability 5 · Generative AI agentsUse case: AI that acts 🤝 SharedAWS Shared Responsibility Model: who implements and operates this control. Customer = you own it; AWS = AWS operates it and you inherit it; Shared = both have obligations.

c5.2 Isolate agent sessions and secure agent memory

Run each agent session in an isolated runtime and organize persistent memory by namespace with encryption and retention limits, so one user's context cannot reach another's.

Foundational
Enhanced
Advanced
Effort: Medium Impact: High GenAI scopesFrom the AWS Generative AI Security Scoping Matrix.: 3 · Pre-trained models; 4 · Fine-tuned models Agentic security dimensionsFrom the AWS Agentic AI Security Scoping Matrix.: Memory & state

Implementation guidance

How to implement on AWS

Run agents on AgentCore Runtime (dedicated microVM per session, memory sanitized on termination). Use AgentCore Memory namespaces (session ID, actor ID, strategy ID) for logical isolation, set short-term retention to the minimum needed, add automated deletion for long-term memory, and encrypt memory/token vaults/log groups with a customer managed KMS key.

Acceptance criteria

Sessions are isolated in microVMs; memory is namespaced by session/actor; retention is minimized with deletion workflows; agent data is CMK-encrypted.

Practical implementation

How this control is implemented in each reference architecture:

Agents run on AgentCore Runtime microVMs in the Generative AI account and memory is namespaced by session/actor, retention-minimized, and CMK-encrypted, so one user's context never reaches another's.

  1. Run agents on AgentCore Runtime so each session gets a dedicated microVM with memory sanitized on termination.
    Generative AI account AgentCore Runtime
  2. Use AgentCore Memory namespaces (session ID, actor ID, strategy ID) for logical isolation, set short-term retention to the minimum, and add automated deletion for long-term memory.
    Generative AI account AgentCore Memory
  3. Encrypt memory, token vaults, and log groups with a customer managed KMS key.
    Generative AI account AWS KMS

How to validate: Sessions are isolated in microVMs; memory is namespaced by session/actor; retention is minimized with deletion workflows; agent data is CMK-encrypted.

Avoid: One shared memory store keyed loosely by user input. Namespace memory server-side and isolate sessions so context cannot bleed across users.

Generative AI OU (multi-account) →

AgentCore Runtime isolates sessions and AgentCore Memory is namespaced, retention-minimized, and CMK-encrypted within the account.

  1. Run agents on AgentCore Runtime (microVM per session, memory sanitized on termination).
    Generative AI tier (IAM role) AgentCore Runtime
  2. Namespace AgentCore Memory by session/actor/strategy, minimize short-term retention, and automate long-term deletion.
    Generative AI tier (IAM role) AgentCore Memory
  3. Encrypt memory, token vaults, and log groups with the customer managed key.
    Generative AI tier (IAM role) AWS KMS

How to validate: Sessions are isolated; memory is namespaced by session/actor; retention is minimized; agent data is CMK-encrypted.

Avoid: Persisting all session memory indefinitely in one bucket. Namespace it, minimize retention, and encrypt it so a leak is bounded.

Single account (entry point) →

Threats addressed

  • Cross-session data contamination between concurrent agent runs.
  • Unauthorized access to another user's persistent agent memory.

AWS services

Amazon Bedrock AgentCore Runtime Amazon Bedrock AgentCore Memory AWS KMS

Framework mappings

OWASP GenAI/LLM Top 10 (2026)

  • LLM02 Sensitive Information Disclosure

NIST AI Risk Management Framework (AI 100-1)

  • MANAGE.1 AI risks are prioritized, responded to and managed

AWS Security Hub — AI Security Best Practices

  • BedrockAgentCore.3 Bedrock AgentCore Memory should be encrypted with customer managed AWS KMS keys

AWS Well-Architected Generative AI Lens (Security)

  • GENSEC05-BP01 Implement least privilege and permission boundaries for agentic workflows

OWASP GenAI Top 10 for Agentic Applications (2025)

  • ASI06 Memory and Context Poisoning

Watch

AWS video: an introduction to Amazon Bedrock AgentCore Runtime — how each agent session runs in an isolated runtime environment, so one user's context and memory cannot reach another.

Learning resources

References

  • AWS SRA for AI — Capability 5, Data protection