AI Security Maturity Model·AWS v1.0.0

Drag to explore · pinch to zoom
Home / Matrix / Capability 6 / c6.3
Foundational AI Application SecurityDefense-in-depth layer: AI Application Capability 6 · AI applicationsUse case: AI that answers 👤 CustomerAWS Shared Responsibility Model: who implements and operates this control. Customer = you own it; AWS = AWS operates it and you inherit it; Shared = both have obligations.

c6.3 Filter user inputs and AI outputs with guardrails

Apply content filtering and validation to what users send and what the AI returns, so the app cannot be misused for prompt injection or to generate harmful content.

Foundational
Enhanced
Advanced
Effort: Low Impact: High GenAI scopesFrom the AWS Generative AI Security Scoping Matrix.: 3 · Pre-trained models

Implementation guidance

How to implement on AWS

Apply Amazon Bedrock Guardrails (content filters, denied topics, PII filters, prompt-attack filters) to user inputs and AI-generated outputs across all application types, invoking a versioned guardrail on every request.

Acceptance criteria

Guardrails run on user inputs and AI outputs; a prompt-injection attempt and a harmful-content sample are blocked; PII is redacted.

Practical implementation

How this control is implemented in each reference architecture:

A versioned guardrail is invoked on every request from the Application account so user inputs and AI outputs are filtered for prompt attacks, harmful content, and PII.

  1. Configure a versioned Bedrock Guardrail with content filters, denied topics, PII filters, and prompt-attack filters.
    Generative AI account Amazon Bedrock
  2. Invoke the guardrail on every request across all application types (inputs and AI-generated outputs).
    Application account → Generative AI account Amazon Bedrock
  3. Redact PII on both inputs and outputs before content reaches the model or the user.
    Generative AI account Amazon Bedrock

How to validate: Guardrails run on user inputs and AI outputs; a prompt-injection attempt and a harmful-content sample are blocked; a PII sample is redacted.

Avoid: Filtering only what the model returns. Users craft injection on the way in; filter both inputs and outputs.

Generative AI OU (multi-account) →

A versioned guardrail runs on every request in the generative AI tier, filtering user inputs and AI outputs and redacting PII.

  1. Configure a versioned Bedrock Guardrail (content, denied topics, PII, prompt-attack filters).
    Generative AI tier (IAM role) Amazon Bedrock
  2. Invoke it on every request for inputs and outputs.
    Application tier (IAM role) Amazon Bedrock
  3. Redact PII on inputs and outputs.
    Generative AI tier (IAM role) Amazon Bedrock

How to validate: Guardrails run on inputs and outputs; injection and harmful content are blocked; PII is redacted.

Avoid: Assuming app users are benign. Filter every request; the interface is an attack surface.

Single account (entry point) →

Threats addressed

  • Prompt injection or inappropriate use through the app interface.
  • Harmful or sensitive content in AI-generated outputs reaching users.

AWS services

Amazon Bedrock Guardrails

Framework mappings

OWASP GenAI/LLM Top 10 (2026)

  • LLM01 Prompt Injection
  • LLM02 Sensitive Information Disclosure

NIST AI Risk Management Framework (AI 100-1)

  • MEASURE.2 AI systems are evaluated for trustworthy characteristics
  • MANAGE.1 AI risks are prioritized, responded to and managed

AWS Well-Architected Generative AI Lens (Security)

  • GENSEC02-BP01 Implement guardrails to mitigate harmful or incorrect model responses
  • GENSEC04-BP02 Sanitize and validate user inputs to foundation models

Learning resources

References

  • AWS SRA for AI — Capability 6, Data protection