Iam Security

<!-- AUTO-GENERATED by export-skills.py — DO NOT EDIT -->
---
name: iam-security
description: AWS IAM and security patterns for AI agent deployments. Use when configuring least-privilege IAM policies for Bedrock agents, setting up VPC endpoints, managing secrets, or implementing guardrails for regulated workloads.
tags: [aws, iam, security, compliance]
---

# AWS IAM Security for AI Agents

Secure AI agent deployments on AWS with least-privilege IAM, VPC endpoints, Secrets Manager, and Bedrock Guardrails.

## When to Use

- Configuring IAM roles for Bedrock agents and Lambda action groups
- Setting up VPC endpoints for private Bedrock access (no public internet)
- Managing enterprise API credentials via Secrets Manager
- Implementing Bedrock Guardrails for PII redaction, content safety, and grounding
- CloudTrail audit logging for compliance

## Patterns

### 1. Least-Privilege IAM for Bedrock Agent

```json
{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Sid": "BedrockAgentInvoke",
      "Effect": "Allow",
      "Action": [
        "bedrock:InvokeModel",
        "bedrock:InvokeModelWithResponseStream"
      ],
      "Resource": "arn:aws:bedrock:us-east-1::foundation-model/anthropic.claude-3-5-sonnet-*"
    },
    {
      "Sid": "BedrockKnowledgeBase",
      "Effect": "Allow",
      "Action": [
        "bedrock:Retrieve",
        "bedrock:RetrieveAndGenerate"
      ],
      "Resource": "arn:aws:bedrock:us-east-1:ACCOUNT:knowledge-base/KB_ID"
    },
    {
      "Sid": "BedrockGuardrails",
      "Effect": "Allow",
      "Action": "bedrock:ApplyGuardrail",
      "Resource": "arn:aws:bedrock:us-east-1:ACCOUNT:guardrail/GUARDRAIL_ID"
    }
  ]
}
```

### 2. VPC Endpoint for Private Bedrock Access

```python
# Terraform/CDK pattern for VPC endpoint
# Ensures Bedrock calls never traverse public internet
vpc_endpoint_config = {
    "service_name": "com.amazonaws.us-east-1.bedrock-runtime",
    "vpc_id": "vpc-xxx",
    "subnet_ids": ["subnet-private-1", "subnet-private-2"],
    "security_group_ids": ["sg-bedrock-endpoint"],
    "private_dns_enabled": True,
}
```

### 3. Secrets Manager for API Credentials

```python
import boto3
import json

secrets = boto3.client("secretsmanager")

def get_enterprise_credentials(secret_name: str) -> dict:
    """Retrieve enterprise API credentials from Secrets Manager."""
    response = secrets.get_secret_value(SecretId=secret_name)
    return json.loads(response["SecretString"])

# Usage in Lambda action group
creds = get_enterprise_credentials("faos/servicenow-api")
sn_user = creds["username"]
sn_pass = creds["password"]
```

### 4. Bedrock Guardrails Configuration

```python
import boto3

bedrock = boto3.client("bedrock")

# Create guardrail for regulated industry
response = bedrock.create_guardrail(
    name="financial-services-guardrail",
    description="Guardrail for financial services AI agents",
    contentPolicyConfig={
        "filtersConfig": [
            {"type": "SEXUAL", "inputStrength": "HIGH", "outputStrength": "HIGH"},
            {"type": "VIOLENCE", "inputStrength": "HIGH", "outputStrength": "HIGH"},
            {"type": "HATE", "inputStrength": "HIGH", "outputStrength": "HIGH"},
            {"type": "INSULTS", "inputStrength": "HIGH", "outputStrength": "HIGH"},
            {"type": "MISCONDUCT", "inputStrength": "HIGH", "outputStrength": "HIGH"},
        ]
    },
    sensitiveInformationPolicyConfig={
        "piiEntitiesConfig": [
            {"type": "US_SOCIAL_SECURITY_NUMBER", "action": "BLOCK"},
            {"type": "CREDIT_DEBIT_CARD_NUMBER", "action": "ANONYMIZE"},
            {"type": "EMAIL", "action": "ANONYMIZE"},
            {"type": "PHONE", "action": "ANONYMIZE"},
            {"type": "NAME", "action": "ANONYMIZE"},
        ]
    },
    topicPolicyConfig={
        "topicsConfig": [
            {
                "name": "investment-advice",
                "definition": "Providing specific investment recommendations or financial advice",
                "type": "DENY",
            }
        ]
    },
    contextualGroundingPolicyConfig={
        "filtersConfig": [
            {"type": "GROUNDING", "threshold": 0.7},
            {"type": "RELEVANCE", "threshold": 0.7},
        ]
    },
)
```

### 5. CloudTrail for Bedrock Audit

```sql
-- Athena query: who invoked which model and when
SELECT
  eventTime,
  userIdentity.arn AS caller,
  requestParameters.modelId AS model,
  responseElements.inputTokenCount AS input_tokens,
  responseElements.outputTokenCount AS output_tokens
FROM cloudtrail_logs
WHERE eventSource = 'bedrock.amazonaws.com'
  AND eventName = 'InvokeModel'
ORDER BY eventTime DESC
LIMIT 100;
```

## Anti-Patterns

- Using AWS root credentials or long-lived access keys -- use IAM roles with assume-role
- Wildcard resource ARNs (`*`) for Bedrock -- scope to specific models and knowledge bases
- Skipping VPC endpoints for regulated workloads -- required for PCI, HIPAA, SOC2
- Storing secrets in Lambda environment variables -- use Secrets Manager with caching
- Not enabling CloudTrail for Bedrock -- required for audit compliance

## References

- [Bedrock Security Best Practices](https://docs.aws.amazon.com/bedrock/latest/userguide/security.html)
- [Bedrock Guardrails](https://docs.aws.amazon.com/bedrock/latest/userguide/guardrails.html)
- [VPC Endpoints for Bedrock](https://docs.aws.amazon.com/bedrock/latest/userguide/vpc-interface-endpoints.html)
- [AWS Secrets Manager](https://docs.aws.amazon.com/secretsmanager/)

<!-- Source: .faos/custom/skills/cloud/aws/iam-security/SKILL.md -->