Visual overview
Macie discovers sensitive S3 data, KMS controls encryption keys, and Bedrock applies supported live inference safeguards.
Technical reference
Data protection follows each derived copy. Apply the right control before, during, and after inference instead of relying on one masking or encryption feature.
Reduce sensitive content before retrieval/inference; do not pass entire records when the task needs one attribute.
Use text-oriented PII detection/redaction in preprocessing or asynchronous data workflows.
Apply supported sensitive-information filters to live prompts and outputs; custom regex can cover organization-specific patterns.
Inventory and classify sensitive content in S3 corpora, logs, and evaluation storage.
Keep supported service traffic on private AWS networking paths while IAM still authorizes the API call.
Deletion and lifecycle policy must include indexes, embeddings, caches, traces, and evaluation copies where applicable.
Service limits and capabilities can change. Values shown here reflect the current AWS documentation; use the linked official sources below as the source of truth.
Map every copy of sensitive context
A GenAI request can create more sensitive-data copies than a traditional API call: raw user prompt, system prompt variables, retrieved documents, embeddings, prompt cache material, model output, invocation logs, traces, evaluation datasets, feedback, and tool arguments. Data protection starts by inventorying those copies and assigning a purpose, owner, classification, access policy, encryption requirement, and retention period to each.
Minimize before inference. If the model needs an account tier but not a full customer record, retrieve the tier rather than passing the entire profile. If RAG needs three authorized chunks, do not attach a complete document repository. Data minimization reduces both privacy exposure and token cost, and it makes later auditing easier because fewer sensitive fields cross the model boundary.
Detect and transform PII at the right boundary
Amazon Comprehend can detect PII entities in text and supports asynchronous redaction workflows. Amazon Bedrock Guardrails sensitive-information filters can detect configured PII or regex patterns in supported prompt/response text and can block or mask detected values. Choose the layer from the workflow: preprocessing may remove data before any model sees it; a guardrail can protect a live input/output path; domain-specific code can pseudonymize identifiers while preserving a reversible mapping in a controlled store when policy permits.
Do not assume masking automatically protects logs. AWS documents that Bedrock invocation logs can contain the original unmodified request even when PII masking is applied to the inference path, and guardrail trace fields can expose the original matched value for application logic. Protect log destinations separately with access control, CloudWatch log data protection where appropriate, encryption, and retention policies.
Encryption and private networking protect transport and storage
Use KMS-backed encryption options where customer-managed key control is required and supported. Key policies and IAM permissions jointly determine whether an application can decrypt protected data; encryption should not be used as a substitute for resource authorization. Secrets Manager is appropriate for application secrets and third-party credentials rather than embedding them in prompts, environment files, or tool descriptions.
VPC interface endpoints powered by AWS PrivateLink can provide private connectivity to supported AWS service endpoints from a VPC without routing that service traffic through an internet gateway or NAT. Private connectivity reduces exposure of the network path, but the request still needs IAM authorization and resource-level data controls. Network location does not make a request trusted.
Discovery and retention keep privacy controls durable
Amazon Macie discovers sensitive data in Amazon S3 using managed and custom data identifiers and can surface security/privacy findings. This is useful for source corpora, evaluation datasets, invocation-log archives, and other S3 data estates. Classification results should drive remediation and access decisions rather than become passive reports.
Define lifecycle and deletion semantics for prompts, outputs, embeddings, caches, logs, and derived data. S3 Lifecycle can transition or expire objects; application databases and indexes need corresponding deletion paths. If a source record is removed for a privacy requirement, derived vector entries and evaluation copies may also need removal. Prove deletion and retention behavior through automated tests and governance evidence.
Key takeaways
- 01
Inventory every prompt, context, output, embedding, log, trace, cache, and evaluation copy that can contain sensitive data.
- 02
Minimize data before model invocation; privacy and token efficiency often reinforce each other.
- 03
Comprehend, Bedrock Guardrails, and Macie address different PII/sensitive-data stages and should be selected by data location and workflow.
- 04
Guardrail masking does not automatically mask invocation logs or every trace field.
- 05
Encryption, private connectivity, authorization, retention, and deletion are separate controls that must all follow the data lifecycle.
Official AWS sources
Use these primary AWS resources for the source material behind this article and for deeper reference.