AI Security Maturity Model·AWS v1.0.0

Drag to explore · pinch to zoom
Home / Matrix / Capability 6 / c6.5
Enhanced Network SecurityDefense-in-depth layer: Infrastructure Capability 6 · AI applicationsUse case: AI that answers 👤 CustomerAWS Shared Responsibility Model: who implements and operates this control. Customer = you own it; AWS = AWS operates it and you inherit it; Shared = both have obligations.

c6.5 Keep AI service access on private connectivity

Reach AI services over PrivateLink so application traffic to models and AI services stays within the AWS network.

Foundational
Enhanced
Advanced
Effort: Medium Impact: Medium GenAI scopesFrom the AWS Generative AI Security Scoping Matrix.: 3 · Pre-trained models

Implementation guidance

How to implement on AWS

Deploy AI applications in private subnets and create VPC endpoints (AWS PrivateLink) for Amazon Bedrock, Q Developer, and other AI services so traffic stays private. Use security groups, network ACLs, and segmentation to isolate AI infrastructure from other workloads.

Acceptance criteria

AI services are reached via PrivateLink endpoints; the app runs in private subnets; segmentation isolates AI infrastructure.

Practical implementation

How this control is implemented in each reference architecture:

AI services are reached over PrivateLink from private subnets, and segmentation isolates the AI application infrastructure from other workloads in the Application account.

  1. Deploy the AI application in private subnets and create VPC endpoints (AWS PrivateLink) for Amazon Bedrock, Q Developer, and other AI services.
    Application account AWS PrivateLink Amazon Bedrock Amazon VPC
  2. Use security groups and network ACLs to permit only the required traffic.
    Application account Amazon VPC
  3. Segment the AI infrastructure from other workloads so a compromise elsewhere does not reach it.
    Application account Amazon VPC

How to validate: AI services are reached via PrivateLink endpoints; the app runs in private subnets; segmentation isolates AI infrastructure.

Avoid: Reaching AI services over the public internet from a flat network. Use PrivateLink and segment the app tier.

Generative AI OU (multi-account) →

PrivateLink endpoints, private subnets, and segmentation keep AI application traffic private within the account.

  1. Run the AI app in private subnets and create PrivateLink endpoints for Bedrock and other AI services.
    Application tier (IAM role) AWS PrivateLink Amazon Bedrock Amazon VPC
  2. Restrict traffic with security groups and network ACLs.
    Application tier (IAM role) Amazon VPC
  3. Segment the AI infrastructure from other in-account workloads.
    Generative AI tier (IAM role) Amazon VPC

How to validate: AI services are reached via PrivateLink; the app runs in private subnets; segmentation isolates the AI tier.

Avoid: A single flat network for the whole account. Segment the AI app and use private connectivity to the services.

Single account (entry point) →

Threats addressed

  • AI application traffic exposed on the public internet.
  • AI application infrastructure not isolated from other workloads.

AWS services

AWS PrivateLink Amazon VPC

Framework mappings

OWASP GenAI/LLM Top 10 (2026)

  • LLM02 Sensitive Information Disclosure

NIST AI Risk Management Framework (AI 100-1)

  • MANAGE.1 AI risks are prioritized, responded to and managed

AWS Well-Architected Generative AI Lens (Security)

  • GENSEC01-BP02 Implement private network communication between foundation models and applications

Learning resources

References

  • AWS SRA for AI — Capability 6, Network security