Resources
Curated links to the official AWS and industry guidance this model is built on.
See how every OWASP LLM Top 10 risk and NIST AI RMF category maps to the AWS controls in this model.
AWS AI security guidance
Securing AI with the right controls, at the right layers, at the right phases.
aws.amazon.com ↗Security Reference Architecture for generative AI workloads.
docs.aws.amazon.com ↗Defines security scope and disciplines by use case (Scopes 1-5).
aws.amazon.com ↗Defines autonomy and agency dimensions for agents.
aws.amazon.com ↗AWS Solutions Library guidance for a governed platform that runs many agents on AgentCore.
docs.aws.amazon.com ↗Key AWS services
Standards & frameworks
The top risks for LLM and generative AI applications.
genai.owasp.org ↗The top risks for agentic AI applications — agents with tools, memory, and autonomy.
genai.owasp.org ↗Voluntary framework to manage AI risks.
www.nist.gov ↗AI management systems standard; AWS holds a certified AIMS.
aws.amazon.com ↗About framework references and attribution
This model maps AWS security controls to several frameworks to help you locate the corresponding control. The frameworks referenced are the property of their respective owners; this is an independent AWS educational resource and is not affiliated with, endorsed by, or approved by those organizations.
The OWASP GenAI/LLM Top 10 and the OWASP Top 10 for Agentic Applications are projects of the OWASP GenAI Security Project and are licensed under Creative Commons Attribution-ShareAlike 4.0 (CC BY-SA 4.0). This model references their risk categories with attribution; where that material is adapted, it is shared under the same CC BY-SA 4.0 license.
The NIST AI Risk Management Framework (AI 100-1) is a publication of the U.S. National Institute of Standards and Technology (NIST); NIST publications are not subject to copyright in the United States, and the source is credited here with thanks.
The AWS Well-Architected Generative AI Lens (Security pillar) is published by AWS; controls are mapped to its security best practices (GENSEC-BP) to aid navigation.
Framework references are provided for navigation and mapping only; this model summarizes and maps to them and is not a substitute for the source documents. Always refer to each framework's official publication as the authoritative source.