AIP-C01 Domain 3: AI Safety, Security, and Governance (20%)

Domain 3 is worth 20% of the AIP-C01 exam. It tests whether you can protect an FM application from harmful inputs and outputs, hallucinations and adversarial attacks, secure and anonymize data, prove compliance, and apply responsible AI principles.

Weight on the exam: 20%. It is one of the five domains of the AWS Certified Generative AI Developer – Professional AIP-C01 exam. Below is a summary of its tasks and skills according to the official AWS guide.

Tasks and skills tested

Task 3.1: Implement input and output safety controls

Protect against harmful user inputs with Bedrock Guardrails, custom moderation workflows in Step Functions and Lambda, and real-time validation.
Prevent harmful outputs with Guardrails on responses, specialized FM evaluations for moderation and toxicity, and text-to-SQL transformations for deterministic results.
Reduce hallucinations by grounding responses with Knowledge Bases, confidence scoring, semantic similarity verification and JSON Schema for structured outputs.
Build defense in depth: Amazon Comprehend pre-processing filters, model-based guardrails, Lambda post-processing validation and API Gateway response filtering.
Detect adversarial inputs with prompt injection and jailbreak detection, input sanitization, safety classifiers and automated adversarial testing.

Task 3.2: Implement data security and privacy controls

Protect FM environments with VPC endpoints, IAM policies, AWS Lake Formation granular data access and CloudWatch monitoring.
Preserve privacy by detecting PII with Amazon Comprehend and Amazon Macie, using Bedrock native privacy features and Guardrails, and applying S3 Lifecycle retention.
Keep FMs useful while protecting users through data masking, PII detection and anonymization strategies.

Task 3.3: Implement AI governance and compliance mechanisms

Build compliance frameworks with SageMaker AI model cards, AWS Glue lineage tracking, metadata tagging and CloudWatch Logs decision logs.
Track data sources with the AWS Glue Data Catalog, source attribution tags in generated content and CloudTrail audit logging.
Create organizational governance that aligns with policies, regulations and responsible AI principles.
Monitor continuously for misuse, drift, bias drift and policy violations, with automated alerting, remediation, token-level redaction and response logging.

Task 3.4: Implement responsible AI principles

Make outputs transparent: reasoning displays, CloudWatch confidence metrics, evidence presentation for source attribution and Bedrock agent tracing.
Evaluate fairness with CloudWatch fairness metrics, Prompt Management and Prompt Flows A/B testing and LLM-as-a-judge evaluations.
Build policy-compliant systems with Guardrails based on policy requirements, model cards that document limitations and automated compliance checks in Lambda.

Services and tools to master

Amazon Bedrock Guardrails
Amazon Bedrock Knowledge Bases
Amazon Comprehend
Amazon Macie
AWS Lake Formation
Amazon VPC endpoints
AWS IAM
Amazon S3 Lifecycle
Amazon SageMaker AI model cards
AWS Glue Data Catalog
AWS CloudTrail
Amazon CloudWatch
AWS Step Functions
AWS Lambda
Amazon API Gateway
Amazon Bedrock Prompt Management

Key facts for domain 3

Short summaries; each links to the study topic with the full note and its official source.

Guardrail policy types — A guardrail can combine content filters, prompt attacks, denied topics, word filters, sensitive information filters, contextual grounding checks and Automated Reasoning checks.
Content filters and prompt attacks — Content filters cover Hate, Insults, Sexual, Violence, Misconduct and Prompt Attack, each with its own filter strength.
Denied topics vs word filters — Use denied topics to keep the application away from whole subjects, such as illegal investment advice.
Block or mask PII — The sensitive information filter either blocks the whole request or response, or masks the PII with its type (for example {NAME} or {EMAIL}).
Masking does not protect your logs — PII masking applies to what goes to and comes from the model, not to model invocation logs: the input field in CloudWatch Logs keeps the original request.
Tool use is not filtered for PII — The sensitive information filter evaluates text only.
Contextual grounding check — A contextual grounding check detects hallucinations by scoring grounding (is the answer supported by the source?) and relevance (does it answer the question?).
Grounding thresholds — Grounding and relevance thresholds range from 0 to 0.99; a higher threshold blocks more responses and lowers the chance of hallucinations reaching users.
Grounding limits and tiers — Grounding checks accept up to 100,000 characters of source, 1,000 of query and 5,000 of response.
Grounding checks and streaming — With a streaming API an irrelevant response can reach the user before the grounding check flags it, because the whole response must be streamed first.
Enforce guardrails with IAM — Add the bedrock:GuardrailIdentifier condition key to IAM policies with an explicit Deny (StringNotEquals) to reject any inference request that does not carry the approved guardrail.
Limits of guardrail enforcement — A role locked to one guardrail should not also be used for RetrieveAndGenerate, InvokeAgent or InvokeInlineAgent, because those make several InvokeModel calls and some carry no guardrail.
Detect mode — A filter action of NONE (detect mode) takes no action but returns detection information, so you can measure how a guardrail would behave before you switch it to block or mask.
Automated Reasoning checks — Automated Reasoning checks validate that model responses follow logical rules you define in natural language, for example that a chatbot only recommends products that are in stock or that financial advice follows regulatory rules.
Model providers cannot see your data — Each model runs in a Model Deployment Account owned and operated by the Amazon Bedrock team, so model providers have no access to Bedrock logs or to customer prompts and completions.
Macie vs Comprehend for PII — The exam guide names Amazon Comprehend and Amazon Macie for detecting PII.
SCPs and inference profiles — For a geographic inference profile your SCP must allow every destination Region in the profile.

Guides that go deeper

Practice Domain 3

Answer practice questions, read the explanation and review your mistakes with spaced repetition.

Start a test