AWS AI Security Maturity Model

The 6 AWS AI security capabilities mapped to tactical security controls across 3 maturity phases.

ⓘ Controls are cumulative: each capability builds on Model inference, and each phase builds on the previous one. You never start over.

Capability	Foundational Zero to prototype	Enhanced Prototype to production	Advanced Continuous improvement and scale
Capability 1 Model inference AI that answers 5 Foundational, 5 Enhanced, 2 Advanced	c1.1 Scope model access with least-privilege IAM LLM02, LLM03 GENSEC01-BP01 Customer c1.2 Encrypt inference data with customer managed KMS keys LLM02 GENSEC01-BP03 Customer c1.3 Filter inputs and outputs with Amazon Bedrock Guardrails LLM01, LLM02 GENSEC02-BP01, GENSEC04-BP02 Customer c1.4 Log every model invocation with CloudTrail and CloudWatch LLM02 GENSEC01-BP04, GENSEC03-BP01 Customer c1.5 Authenticate users before they reach the model LLM02 GENSEC01-BP01 Customer	c1.6 Protect the endpoint with AWS WAF and rate limiting LLM01, LLM06 GENSEC04-BP02 Customer c1.7 Keep model access private with VPC endpoints LLM02 GENSEC01-BP02 Customer c1.8 Detect and redact PII in prompts and responses LLM02 GENSEC01-BP03 Customer c1.9 Validate model outputs before downstream use LLM07, LLM10 GENSEC02-BP01 Customer c1.10 Enable AI-aware threat detection LLM02, LLM06 GENSEC03-BP01 Customer	c1.11 Isolate AI workloads across accounts with guardrails LLM05 GENSEC03-BP01 Customer c1.12 Evaluate models and monitor for drift LLM05, LLM07 GENSEC02-BP01 Customer
Capability 2 Model customization AI you build 3 Foundational, 4 Enhanced, 2 Advanced	c2.1 Encrypt the customization job, data, and model with a CMK LLM05 GENSEC01-BP03 Customer c2.2 Use a least-privilege service role for customization and import LLM05 GENSEC01-BP01 Customer c2.3 Protect training-data integrity with S3 Object Lock and versioning LLM05 GENSEC06-BP01 Customer	c2.4 Run customization privately in a VPC with no internet LLM02 GENSEC01-BP02 Customer c2.5 Discover sensitive data in training sets with Macie LLM02, LLM05 GENSEC06-BP01 Customer c2.6 Import models safely with Safetensors, not pickle LLM04, LLM05 GENSEC06-BP01 Customer c2.7 Detect training-data leakage with canaries LLM02, LLM05 GENSEC03-BP01 Customer	c2.8 Secure the model promotion workflow across accounts LLM04, LLM05 GENSEC01-BP01 Customer c2.9 Monitor customized models for drift and bias LLM05, LLM07 GENSEC03-BP01 Customer
Capability 3 Retrieval-augmented generation (RAG) AI that connects 2 Foundational, 5 Enhanced, 2 Advanced	c3.1 Encrypt the knowledge base and vector store with a CMK LLM02 GENSEC01-BP03 Customer c3.2 Use a least-privilege service role for the knowledge base LLM02 GENSEC01-BP03 Customer	c3.3 Enforce retrieval access control with metadata filtering LLM02, LLM08 GENSEC01-BP03 Customer c3.4 Validate and scan documents before ingestion LLM01, LLM05 GENSEC06-BP01 Customer c3.5 Classify and tag data at ingestion LLM02, LLM08 GENSEC01-BP03 Customer c3.6 Keep the vector store on private connectivity LLM02 GENSEC01-BP02 Customer c3.7 Secure the vector store and embedding integrity LLM09 GENSEC01-BP03 Customer	c3.8 Track data lineage and provenance across the RAG pipeline LLM08 GENSEC03-BP01 Customer c3.9 Ground and validate responses against retrieved sources LLM07, LLM08, LLM10 GENSEC02-BP01 Customer
Capability 4 Tools AI that acts 3 Foundational, 4 Enhanced, 1 Advanced	c4.1 Scope tool roles with least privilege and permission boundaries LLM03, LLM06 ASI03, ASI02 GENSEC05-BP01 Customer c4.2 Broker tool credentials through AgentCore Identity LLM03 ASI03 GENSEC05-BP01 Customer c4.3 Encrypt tool I/O and isolate tool sessions LLM02 ASI06 GENSEC01-BP03 Shared	c4.4 Centralize tools behind AgentCore Gateway with rate limits LLM03, LLM06 ASI02 GENSEC05-BP01, GENSEC04-BP02 Customer c4.5 Filter tool inputs and outputs with Guardrails LLM01, LLM03 ASI01, ASI02 GENSEC02-BP01 Customer c4.6 Keep tool integration on private connectivity LLM02 ASI07 GENSEC01-BP02 Customer c4.7 Constrain Lambda-based tools LLM06 ASI05 GENSEC05-BP01 Customer	c4.8 Log tool invocations with user attribution and observability LLM03, LLM06 ASI08 GENSEC03-BP01 Customer
Capability 5 Generative AI agents AI that acts 3 Foundational, 5 Enhanced, 2 Advanced	c5.1 Give each agent its own scoped identity LLM03 ASI03 GENSEC05-BP01 Customer c5.2 Isolate agent sessions and secure agent memory LLM02 ASI06 GENSEC05-BP01 Shared c5.3 Prevent agent memory poisoning LLM01, LLM05 ASI06 GENSEC06-BP01, GENSEC05-BP01 Customer	c5.4 Grant agents least-privilege roles with no escalation path LLM03 ASI03 GENSEC05-BP01 Customer c5.5 Require human approval for high-consequence actions LLM03 ASI09 GENSEC05-BP01 Customer c5.6 Harden agent prompts and validate input with Guardrails LLM01, LLM07 ASI01 GENSEC04-BP01, GENSEC04-BP02 Customer c5.7 Keep agents private and protect public agent apps LLM02, LLM06 ASI07 GENSEC01-BP02 Customer c5.8 Limit destructive operations and justify each tool LLM03, LLM06 ASI01, ASI02 GENSEC05-BP01 Customer	c5.9 Trace agent reasoning, memory, and tool chains LLM03 ASI08 GENSEC03-BP01 Customer c5.10 Adversarially test and review agents LLM01, LLM03 ASI10, ASI04 GENSEC05-BP01 Customer
Capability 6 AI applications AI that answers 3 Foundational, 4 Enhanced, 1 Advanced	c6.1 Centralize identity and least-privilege access for AI apps LLM02 GENSEC01-BP01 Customer c6.2 Encrypt user data and isolate sessions LLM02 GENSEC01-BP03 Shared c6.3 Filter user inputs and AI outputs with guardrails LLM01, LLM02 GENSEC02-BP01, GENSEC04-BP02 Customer	c6.4 Protect the app interface with WAF and TLS LLM01, LLM06 GENSEC04-BP02 Customer c6.5 Keep AI service access on private connectivity LLM02 GENSEC01-BP02 Customer c6.6 Store application credentials in Secrets Manager LLM02 GENSEC01-BP03 Customer c6.7 Monitor AI application usage with attributed audit logs LLM02, LLM06 GENSEC03-BP01 Customer	c6.8 Automate response to AI application security events LLM06 GENSEC03-BP01 Customer