AI Security Maturity Model·AWS v1.0.0

Drag to explore · pinch to zoom
Home / Matrix / Capability 6 / c6.1
Foundational Identity and Access ManagementDefense-in-depth layer: Identity & Data Capability 6 · AI applicationsUse case: AI that answers 👤 CustomerAWS Shared Responsibility Model: who implements and operates this control. Customer = you own it; AWS = AWS operates it and you inherit it; Shared = both have obligations.

c6.1 Centralize identity and least-privilege access for AI apps

Authenticate users to AI applications through a central identity source and grant granular, role-based permissions, so only the right users reach the right AI features and data.

Foundational
Enhanced
Advanced
Effort: Medium Impact: High GenAI scopesFrom the AWS Generative AI Security Scoping Matrix.: 3 · Pre-trained models

Implementation guidance

How to implement on AWS

Use AWS IAM Identity Center for centralized identity and SSO across AI apps (Amazon Q Developer, Quick, Kiro, or custom), federating with Cognito/Okta/Entra ID. Create least-privilege IAM policies that control which users access which features and data sources, and apply permission boundaries/SCPs to prevent escalation.

Acceptance criteria

AI apps authenticate through a central identity source with SSO; per-user access is least-privilege and role-based; escalation is bounded by permission boundaries/SCPs.

Practical implementation

How this control is implemented in each reference architecture:

IAM Identity Center provides central SSO for all AI apps in the Application account, with least-privilege role-based access and OU-level SCPs bounding escalation.

  1. Use AWS IAM Identity Center for centralized identity and SSO across AI apps (Q Developer, Quick, Kiro, or custom), federating with Cognito/Okta/Entra ID.
    Application account IAM Identity Center Amazon Cognito
  2. Create least-privilege IAM policies controlling which users reach which features and data sources.
    Application account IAM
  3. Apply permission boundaries and OU-level SCPs to prevent privilege escalation across the Generative AI OU.
    Generative AI OU (guardrail) IAM AWS Organizations

How to validate: AI apps authenticate through a central identity source with SSO; per-user access is least-privilege and role-based; an escalation attempt is blocked by permission boundaries/SCPs.

Avoid: A separate local login per AI app. Inconsistent auth means gaps; centralize identity and enforce least-privilege from one source.

Generative AI OU (multi-account) →

IAM Identity Center (or Cognito) centralizes AI-app authentication in the account with least-privilege role-based access and permission boundaries.

  1. Use IAM Identity Center for centralized SSO across the AI apps, federating with your IdP.
    Application tier (IAM role) IAM Identity Center Amazon Cognito
  2. Write least-privilege IAM policies controlling which users reach which features/data.
    Application tier (IAM role) IAM
  3. Apply permission boundaries to bound escalation within the account.
    Application tier (IAM role) IAM

How to validate: AI apps authenticate through a central source with SSO; per-user access is least-privilege; escalation is bounded by permission boundaries.

Avoid: Per-app credentials scattered across the account. Centralize identity so access is consistent and auditable.

Single account (entry point) →

Threats addressed

  • Inconsistent authentication across multiple AI applications.
  • Users reaching AI features or data sources beyond their role.

AWS services

AWS IAM Identity Center Amazon Cognito AWS IAM

Framework mappings

OWASP GenAI/LLM Top 10 (2026)

  • LLM02 Sensitive Information Disclosure

NIST AI Risk Management Framework (AI 100-1)

  • MANAGE.1 AI risks are prioritized, responded to and managed

AWS Well-Architected Generative AI Lens (Security)

  • GENSEC01-BP01 Grant least privilege access to foundation model endpoints

Learning resources

References

  • AWS SRA for AI — Capability 6, Identity and access management