Security, Compliance & Governance

Least privilege — grant each role, user, or service only the minimal permissions needed for its task, scoped to specific actions and resources.

Via an IAM execution role attached to the job, not long-lived static keys. The role grants temporary, scoped credentials.

Identity-based policies attach to users/roles defining what they can do; resource-based policies attach to a resource (e.g., S3 bucket) defining who can access it.

AWS KMS (Key Management Service) — creates and controls cryptographic keys used to encrypt data in S3, SageMaker, Bedrock, and other services.

Stored data — training datasets in S3, model artifacts, and notebook volumes — so that data on disk is unreadable without the key.

Data moving over the network — typically via TLS/HTTPS — so prompts, responses, and dataset transfers cannot be intercepted in flight.