Private paths to models
Lesson 1 of 3 in Data Security and Privacy for GenAI.
Start with what Bedrock already promises, because exam distractors love to violate it: your prompts and completions are not used to train the base models and are not shared with model providers; when you fine-tune, AWS works on a private copy of the model that only you use; content is encrypted in transit and at rest, with KMS where you hold the key. Those are platform guarantees. Everything else — the network path, the caller's identity, the blast radius of a leaked credential — is a perimeter you build, and it has four walls.
Network: an interface VPC endpoint (AWS PrivateLink) for the Bedrock runtime keeps invocation traffic on the AWS private network — prompts full of customer context never traverse the public internet, and the endpoint's own policy is a first gate. The same VPC discipline extends down the stack: model-customization jobs and batch inference can run VPC-protected, and a Knowledge Base reaches its OpenSearch Serverless index through an interface endpoint. Identity: least-privilege IAM on invocation, plus condition keys like aws:SourceVpce so a deny statement refuses model calls from anywhere but your endpoint — a stolen credential outside the VPC becomes a dead credential. Data granularity: Lake Formation governs the RAG lake itself, granting at table and column level in the Glue Data Catalog rather than bucket-wide. Visibility: CloudWatch and CloudTrail watch who touched what, which closes the loop in the governance module.
The private invocation path — and where off-perimeter calls die
- App in private subnet
No internet gateway on its route table. Prompts carry customer context — the path matters as much as the payload.
- Interface endpoint (PrivateLink)
A bedrock-runtime endpoint in your VPC. Traffic stays on the AWS network; the endpoint policy is the first gate — it can pin which principals and actions pass at all.
- IAM evaluation
The caller’s role must allow the invocation — and a deny with aws:SourceVpce refuses any call that did not arrive through your endpoint, no matter whose credentials it carries.
- Bedrock runtime
SigV4-authenticated, TLS-encrypted, KMS at rest. Content is not used to train base models and is not shared with providers.
- Answer + audit trail
CloudTrail records the API call; model invocation logging (if enabled) captures the content to your bucket under your keys.
- AccessDenied
The fate of a leaked key used from a laptop, or an off-VPC service: valid credentials, wrong path, no inference.
| The requirement says… | The control | Why the others fail |
|---|---|---|
“must not traverse the public internet” | Interface VPC endpoint (PrivateLink) for the Bedrock runtime | NAT gateways and proxies still ride the internet; TLS encrypts the path but does not change it. |
“only callable from our network” | IAM deny unless | Security groups guard instances, not identities; a leaked key works from anywhere until a condition key says otherwise. |
“analysts may see only their region’s columns” | Lake Formation grants on Data Catalog tables/columns | S3 bucket policies stop at object granularity; IAM alone cannot see inside a table. |
“prove who accessed the data” | CloudTrail + CloudWatch monitoring of access patterns | Guardrails filter content; they do not record who read what. |
Interactive checkpoint quiz (2 questions) — open this page in a browser to take it.