Iam Security

name: iam-security description: AWS IAM and security patterns for AI agent deployments. Use when configuring least-privilege IAM policies for Bedrock agents, setting up VPC endpoints, managing secrets, or implementing guardrails for regulated workloads. tags: [aws, iam, security, compliance]

AWS IAM Security for AI Agents

Secure AI agent deployments on AWS with least-privilege IAM, VPC endpoints, Secrets Manager, and Bedrock Guardrails.

When to Use

• Configuring IAM roles for Bedrock agents and Lambda action groups
• Setting up VPC endpoints for private Bedrock access (no public internet)
• Managing enterprise API credentials via Secrets Manager
• Implementing Bedrock Guardrails for PII redaction, content safety, and grounding
• CloudTrail audit logging for compliance

Patterns

1. Least-Privilege IAM for Bedrock Agent

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Sid": "BedrockAgentInvoke",
      "Effect": "Allow",
      "Action": [
        "bedrock:InvokeModel",
        "bedrock:InvokeModelWithResponseStream"
      ],
      "Resource": "arn:aws:bedrock:us-east-1::foundation-model/anthropic.claude-3-5-sonnet-*"
    },
    {
      "Sid": "BedrockKnowledgeBase",
      "Effect": "Allow",
      "Action": [
        "bedrock:Retrieve",
        "bedrock:RetrieveAndGenerate"
      ],
      "Resource": "arn:aws:bedrock:us-east-1:ACCOUNT:knowledge-base/KB_ID"
    },
    {
      "Sid": "BedrockGuardrails",
      "Effect": "Allow",
      "Action": "bedrock:ApplyGuardrail",
      "Resource": "arn:aws:bedrock:us-east-1:ACCOUNT:guardrail/GUARDRAIL_ID"
    }
  ]
}

2. VPC Endpoint for Private Bedrock Access

# Terraform/CDK pattern for VPC endpoint
# Ensures Bedrock calls never traverse public internet
vpc_endpoint_config = {
    "service_name": "com.amazonaws.us-east-1.bedrock-runtime",
    "vpc_id": "vpc-xxx",
    "subnet_ids": ["subnet-private-1", "subnet-private-2"],
    "security_group_ids": ["sg-bedrock-endpoint"],
    "private_dns_enabled": True,
}

3. Secrets Manager for API Credentials

import boto3
import json

secrets = boto3.client("secretsmanager")

def get_enterprise_credentials(secret_name: str) -> dict:
    """Retrieve enterprise API credentials from Secrets Manager."""
    response = secrets.get_secret_value(SecretId=secret_name)
    return json.loads(response["SecretString"])

# Usage in Lambda action group
creds = get_enterprise_credentials("faos/servicenow-api")
sn_user = creds["username"]
sn_pass = creds["password"]

4. Bedrock Guardrails Configuration

import boto3

bedrock = boto3.client("bedrock")

# Create guardrail for regulated industry
response = bedrock.create_guardrail(
    name="financial-services-guardrail",
    description="Guardrail for financial services AI agents",
    contentPolicyConfig={
        "filtersConfig": [
            {"type": "SEXUAL", "inputStrength": "HIGH", "outputStrength": "HIGH"},
            {"type": "VIOLENCE", "inputStrength": "HIGH", "outputStrength": "HIGH"},
            {"type": "HATE", "inputStrength": "HIGH", "outputStrength": "HIGH"},
            {"type": "INSULTS", "inputStrength": "HIGH", "outputStrength": "HIGH"},
            {"type": "MISCONDUCT", "inputStrength": "HIGH", "outputStrength": "HIGH"},
        ]
    },
    sensitiveInformationPolicyConfig={
        "piiEntitiesConfig": [
            {"type": "US_SOCIAL_SECURITY_NUMBER", "action": "BLOCK"},
            {"type": "CREDIT_DEBIT_CARD_NUMBER", "action": "ANONYMIZE"},
            {"type": "EMAIL", "action": "ANONYMIZE"},
            {"type": "PHONE", "action": "ANONYMIZE"},
            {"type": "NAME", "action": "ANONYMIZE"},
        ]
    },
    topicPolicyConfig={
        "topicsConfig": [
            {
                "name": "investment-advice",
                "definition": "Providing specific investment recommendations or financial advice",
                "type": "DENY",
            }
        ]
    },
    contextualGroundingPolicyConfig={
        "filtersConfig": [
            {"type": "GROUNDING", "threshold": 0.7},
            {"type": "RELEVANCE", "threshold": 0.7},
        ]
    },
)

5. CloudTrail for Bedrock Audit

-- Athena query: who invoked which model and when
SELECT
  eventTime,
  userIdentity.arn AS caller,
  requestParameters.modelId AS model,
  responseElements.inputTokenCount AS input_tokens,
  responseElements.outputTokenCount AS output_tokens
FROM cloudtrail_logs
WHERE eventSource = 'bedrock.amazonaws.com'
  AND eventName = 'InvokeModel'
ORDER BY eventTime DESC
LIMIT 100;

Anti-Patterns

• Using AWS root credentials or long-lived access keys -- use IAM roles with assume-role
• Wildcard resource ARNs (*) for Bedrock -- scope to specific models and knowledge bases
• Skipping VPC endpoints for regulated workloads -- required for PCI, HIPAA, SOC2
• Storing secrets in Lambda environment variables -- use Secrets Manager with caching
• Not enabling CloudTrail for Bedrock -- required for audit compliance

References

• Bedrock Security Best Practices
• Bedrock Guardrails
• VPC Endpoints for Bedrock
• AWS Secrets Manager