Generative AI applications often integrate multiple services and features, such as Amazon Bedrock and large language models (LLMs), to create content and access potentially sensitive information. This integration necessitates robust identity and access management controls, which must be implemented at various levels. In this post, we will explore scenarios and strategies for applying least privilege access to applications utilizing Amazon Bedrock. To maximize the insights from this article, a foundational understanding of AWS APIs, AWS Identity and Access Management (IAM) policies, and AWS security services is essential.
Understanding the Principle of Least Privilege
To begin, let’s clarify the principle of least privilege (PoLP). The PoLP is a security guideline that recommends granting users, programs, or systems the minimum level of access—or permissions—necessary to perform their functions. The core idea is that reducing the number of permissions an entity possesses diminishes the risk of both malicious and accidental harm. Applying the PoLP in your AWS environment serves two key purposes:
- Security: Restricting access mitigates the potential impact of a security breach. When users or services have limited permissions, the potential for damage can be significantly curtailed.
- Operational Simplicity: Without careful management, permissions can become unwieldy. Adopting the PoLP early in your access control strategy helps maintain manageable configurations. Additionally, various regulatory frameworks necessitate a clear separation of duties and a documented approach to access controls, achievable in part through adherence to the PoLP.
Overview of Amazon Bedrock
Amazon Bedrock is a fully managed AWS service providing high-performing foundation models (FMs) via a single unified API. You interact with Amazon Bedrock through AWS APIs, which facilitate actions for both control plane and administrative functions—such as configuring Amazon Bedrock Guardrails and Amazon Bedrock Agents—as well as data plane functional actions like inference.
Stages of Utilizing Amazon Bedrock
Typically, the process of utilizing Amazon Bedrock for a production workload encompasses the following stages:
- Model Selection: Identify the required features (such as Retrieval Augmented Generation (RAG) and fine-tuning), evaluate and choose a model, and approve a EULA if needed.
- Model Adaptation: Engage in prompt engineering, integrate Amazon Bedrock into your application, and add model customization as desired.
- Model Testing: Validate and test the solution.
- Model Operation: Deploy the solution, monitor its performance, and manage it accordingly.
In the sections that follow, we will delve into each stage and discuss how to effectively apply the PoLP.
Model Selection
In this phase, you decide on the necessary features and models to meet your requirements and outline how to implement the PoLP. This may involve model customization, RAG, or the utilization of agents. Security should be embedded in the design process, ensuring that established controls can be integrated during development. One effective method for defining the necessary security controls is threat modeling, which simplifies subsequent phases. The results can inform decisions regarding required guardrails, potential architectural adjustments, and test cases.
You will also determine the deployment strategy for your solution. Many customers operate within a multi-account environment; thus, selecting target organizational units (OUs) and accounts is crucial. We advise establishing a new OU specifically for generative AI applications. For further insights, refer to this excellent resource. The generative AI OU is an ideal location for enforcing those guardrails.
Amazon Bedrock provides access to a variety of high-performing FMs from leading AI companies, including AI21 Labs, Anthropic, Cohere, Meta, Mistral AI, Stability AI, and Amazon. During this stage, you will select and approve the models you intend to use. For third-party FMs, this process may involve accepting a EULA. You can restrict identities and the models they can subscribe to in order to ensure compliance with EULAs vetted by your legal department.
Example Identity-Based Policy
{
"Version": "2012-10-17",
"Statement": [
{
"Sid": "AllowAcceptingModelEULAs",
"Effect": "Allow",
"Action": [
"aws-marketplace:Subscribe"
],
"Resource": "*",
"Condition": {
"Null": {
"aws-marketplace:ProductId": "false"
},
"ForAllValues:StringEquals": {
"aws-marketplace:ProductId": [
"c468b48a-84df-43a4-8c46-8870630108a7",
"b0eb9475-3a2c-43d1-94d3-56756fd43737",
"prod-6dw3qvchef7zy",
"prod-m5ilt4siql27k",
"prod-ozonys2hmmpeu",
"prod-fm3feywmwerog",
"prod-2c2yc2s3guhqy"
]
}
}
},
{
"Sid": "AllowUnsubscribingFromModels",
"Effect": "Allow",
"Action": [
"aws-marketplace:Unsubscribe",
"aws-marketplace:ViewSubscriptions"
],
"Resource": "*"
}
]
}While this policy functions effectively for allowlisting actions, highly privileged users may already possess broad access to AWS Marketplace APIs. In such cases, you can adopt a deny-all-except-for-specified approach. An example policy, using the same models, could look like this:
Example Deny-All-Except Policy
{
"Version": "2012-10-17",
"Statement": [
{
"Sid": "DenyAcceptingAllExceptCertainModelEULAs",
"Effect": "Deny",
"Action": [
"aws-marketplace:Subscribe"
],
"Resource": "*",
"Condition": {
"ForAnyValue:StringNotEquals": {
"aws-marketplace:ProductId": [
"c468b48a-84df-43a4-8c46-8870630108a7",
"b0eb9475-3a2c-43d1-94d3-56756fd43737",
"prod-6dw3qvchef7zy",
"prod-m5ilt4siql27k",
"prod-ozonys2hmmpeu",
"prod-fm3feywmwerog",
"prod-2c2yc2s3guhqy"
]
}
}
},
{
"Sid": "DenyUnsubscribingAllExceptCertainModels",
"Effect": "Deny",
"Action": [
"aws-marketplace:Unsubscribe",
"aws-marketplace:ViewSubscriptions"
],
"Resource": "*",
"Condition": {
"ForAnyValue:StringNotEquals": {
"aws-marketplace:ProductId": [
"c468b48a-84df-43a4-8c46-8870630108a7",
"b0eb9475-3a2c-43d1-94d3-56756fd43737",
"prod-6dw3qvchef7zy",
"prod-m5ilt4siql27k",
"prod-ozonys2hmmpeu",
"prod-fm3feywmwerog",
"prod-2c2yc2s3guhqy"
]
}
}
}
]
}You can find the necessary product IDs used in the conditions within the resource “Grant IAM permissions to request access to Amazon Bedrock foundation models.”
Model Adaptation
During this phase, the solution is constructed, meaning code is developed. While largely similar to traditional software development, there are unique aspects related to generative AI, such as prompt engineering. This is another blog post to keep the reader engaged.
Conclusion
In conclusion, implementing least privilege access is essential for maintaining security and operational efficiency when using Amazon Bedrock and other AWS services. By following the outlined steps and strategies, you can ensure a robust and compliant environment for your generative AI applications.
Location: Amazon IXD – VGT2, 6401 E Howdy Wells Ave, Las Vegas, NV 89115
Leave a Reply