Architecture-specific review
Amazon Bedrock security review
Bedrock supplies model access and security capabilities. A production review still has to establish the application's authority chain, data paths, agent actions and evidence for each required control.
Start an AI security review →Review scope
What the reviewer needs to establish
Review the workload that calls Bedrock, its AWS accounts and connected systems. A configured guardrail or VPC endpoint addresses a specific boundary; neither should be treated as proof that every tool call or retrieved document is safe.
IAM and model invocation
Which principals can invoke which models and change guardrail or logging configuration? Are application actions constrained independently of model access?
Evidence to request: IAM policies and roles, trust relationships, model resource scope, change permissions and the application authorization path.
Network and data movement
What network path does the workload use, and where do prompts, outputs, retrieved content and invocation logs go?
Evidence to request: VPC endpoint and endpoint policy where used, data-flow diagram, storage access, encryption choices and logging configuration.
Retrieval and untrusted content
Can retrieved or user-supplied content redirect the agent or expose another user's data?
Evidence to request: Ingestion boundaries, retrieval filters, source attribution, prompt construction and adversarial test cases.
Guardrails and tool permissions
Where are guardrails applied and enforced? Can the agent take actions outside the user's authorized scope or bypass a required approval?
Evidence to request: Guardrail attachment and IAM enforcement, tool schemas, server-side permission checks, human approval and audit events.
Observability and clearance
Which events are logged without leaking sensitive payloads? What gaps remain and who accepts the conditions of release?
Evidence to request: Invocation and audit logging settings, access to logs, test results, control owners and the signed review decision.
Architecture example
Follow authority and data end to end
A model endpoint is one component. The security decision also depends on the identity that calls it, the data it receives, the actions it can trigger, and who accepts the remaining risk.
For a claims assistant: employee request → application identity → Bedrock model invocation → retrieval from an approved data source → proposed claim update. Trace both the employee's right to see the claim and the service role's right to modify it. A model instruction cannot grant either permission.
From review to decision
Describe the system, confirm its architecture, examine threats and required controls, attach evidence, and record a human clearance decision. Unknown or missing evidence remains visible; it is not treated as a passed control.
Read the review methodology →