AI Security Maturity Model·AWS v1.0.0

Drag to explore · pinch to zoom
Home / Matrix / Capability 6 / c6.2
Foundational Data ProtectionDefense-in-depth layer: Identity & Data Capability 6 · AI applicationsUse case: AI that answers 🤝 SharedAWS Shared Responsibility Model: who implements and operates this control. Customer = you own it; AWS = AWS operates it and you inherit it; Shared = both have obligations.

c6.2 Encrypt user data and isolate sessions

Encrypt user inputs, conversation history, and AI-generated outputs with a customer managed key, and isolate sessions so one user's context cannot reach another's.

Foundational
Enhanced
Advanced
Effort: Low Impact: High GenAI scopesFrom the AWS Generative AI Security Scoping Matrix.: 3 · Pre-trained models

Implementation guidance

How to implement on AWS

Encrypt inputs, conversation history, and outputs in transit (TLS 1.2+) and at rest with a customer managed KMS key (Q Developer, Quick, and Kiro support customer managed keys). Isolate user sessions and set retention/memory policies aligned to your compliance obligations.

Acceptance criteria

User data is CMK-encrypted in transit and at rest; sessions are isolated per user; retention policies are enforced.

Practical implementation

How this control is implemented in each reference architecture:

User inputs, conversation history, and outputs are CMK-encrypted in transit and at rest, sessions are isolated per user, and retention aligns to compliance obligations.

  1. Encrypt inputs, conversation history, and outputs in transit (TLS 1.2+) and at rest with a customer managed KMS key (Q Developer, Quick, Kiro support CMKs).
    Application account AWS KMS
  2. Isolate user sessions so one user's context cannot reach another's.
    Application account IAM Identity Center
  3. Set retention and memory policies aligned to your compliance obligations, and keep the KMS key scoped to the app roles.
    Application account AWS KMS IAM

How to validate: User data is CMK-encrypted in transit and at rest; sessions are isolated per user; retention policies are enforced.

Avoid: Persisting conversation history on default keys with no retention limit. Encrypt with your own key and bound how long user data lives.

Generative AI OU (multi-account) →

CMK encryption in transit and at rest, per-user session isolation, and enforced retention protect user data within the account.

  1. Encrypt inputs, history, and outputs in transit (TLS 1.2+) and at rest with a customer managed KMS key.
    Application tier (IAM role) AWS KMS
  2. Isolate user sessions to prevent cross-user context leakage.
    Application tier (IAM role) IAM Identity Center
  3. Enforce retention/memory policies aligned to compliance.
    Application tier (IAM role) AWS KMS

How to validate: User data is CMK-encrypted in transit and at rest; sessions are isolated; retention is enforced.

Avoid: Keeping all user history forever on a shared key. Scope encryption and retention to what compliance requires.

Single account (entry point) →

Threats addressed

  • Sensitive user inputs or AI outputs readable if default keys or storage are compromised.
  • Data leakage between user sessions or across AI applications.

AWS services

AWS KMS AWS IAM Identity Center

Framework mappings

OWASP GenAI/LLM Top 10 (2026)

  • LLM02 Sensitive Information Disclosure

NIST AI Risk Management Framework (AI 100-1)

  • MANAGE.1 AI risks are prioritized, responded to and managed

AWS Well-Architected Generative AI Lens (Security)

  • GENSEC01-BP03 Implement least privilege access to data stores

Learning resources

References

  • AWS SRA for AI — Capability 6, Data protection