Profile Applicability:
- Level 2
Description:
Amazon Bedrock is a fully managed service that allows you to build and deploy generative AI applications. It provides logging for model invocations to track interactions with the AI models. These logs can contain sensitive information, and it is essential to encrypt them to ensure that the data is protected both in transit and at rest. This SOP ensures that Amazon Bedrock model invocation logs are encrypted with KMS (Key Management Service), providing an additional layer of security and compliance.
Rationale:
Data Security: Enabling KMS encryption ensures that logs containing sensitive or personally identifiable information (PII) are protected from unauthorized access. This is critical for safeguarding customer data and meeting compliance requirements.
Compliance: Various regulatory standards, such as HIPAA, PCI-DSS, and SOC 2, require encryption of sensitive logs and data to ensure data privacy and security.
Audit and Tracking: With encrypted logs, organizations can safely store logs for auditing and troubleshooting purposes without risking exposure to unauthorized entities.
Impact:
Pros:
Enhanced Data Security: Encrypting logs with KMS ensures that the logs are secure, even if an unauthorized user gains access to the storage.
Regulatory Compliance: Ensures that you meet the encryption requirements of various compliance frameworks (e.g., HIPAA, PCI-DSS, SOC 2).
Auditability: Provides a secure mechanism for tracking interactions with AI models without exposing sensitive data.
Cons:
Management Overhead: Implementing and managing KMS keys adds a layer of administrative overhead, including key rotation and permissions management.
Potential Latency: Encryption and decryption of logs with KMS may introduce slight latency, though the impact is typically minimal.
Default Value:
By default, Amazon Bedrock may not have model invocation logs encrypted with KMS. The logs may be stored in plain text unless encryption is explicitly enabled during the setup.
Pre-requisite:
AWS IAM Permissions:
bedrock:DescribeModel
bedrock:UpdateModel
kms:Encrypt
kms:Decrypt
kms:CreateKey
AWS CLI installed and configured.
KMS Key created for encryption, and appropriate IAM policies in place to allow access to the KMS key.
Access to Amazon Bedrock and an existing AI model deployed for logging and encryption configuration.
Test Plan:
Using AWS Console:
Sign in to the AWS Management Console.
Navigate to Amazon Bedrock under Services.
In the Amazon Bedrock Console, go to the Model Settings for the model that needs to have logs encrypted.
Review the model invocation log settings:
If logs are not encrypted, navigate to the encryption settings and choose Enable encryption with KMS.
Select the KMS Key to use for encryption or create a new key.
Save the configuration and confirm that the logs are now encrypted with KMS.
Verify by reviewing logs in CloudWatch and ensuring they are encrypted.
Using AWS CLI:
To check if KMS encryption is enabled for model invocation logs, run the following command:
aws bedrock describe-model --model-id <model-id> --query 'Model.InvocationLogs.Encryption'
Review the output:
If Encryption is set to KMS, the model invocation logs are encrypted with KMS.
If Encryption is not set to KMS, proceed with enabling KMS encryption.
To enable KMS encryption for model invocation logs, run:
aws bedrock update-model --model-id <model-id> --log-encryption-type KMS --kms-key-id <kms-key-id>
Verify that the KMS encryption is enabled by running:
aws bedrock describe-model --model-id <model-id> --query 'Model.InvocationLogs.Encryption'
Implementation Steps:
Using AWS Console:
Log in to the AWS Management Console and navigate to Amazon Bedrock.
In the Amazon Bedrock Console, go to the Model Settings for the AI model you want to configure.
Enable KMS encryption for model invocation logs:
Under the Logging Configuration, select Encrypt with KMS and choose the KMS Key to be used for encryption.
Save the changes and confirm that the KMS encryption is applied to the logs.
Ensure that logs are securely encrypted by checking logs in CloudWatch.
Using AWS CLI:
To enable KMS encryption for model invocation logs, use the following command:
aws bedrock update-model --model-id <model-id> --log-encryption-type KMS --kms-key-id <kms-key-id>Verify the update by checking the encryption status:
aws bedrock describe-model --model-id <model-id> --query 'Model.InvocationLogs.Encryption'
Backout Plan:
Using AWS Console:
If enabling KMS encryption causes issues, sign in to the AWS Management Console.
Navigate to Amazon Bedrock, and go to Model Settings or Logging.
Disable KMS encryption and save the changes.
Verify that the logs are no longer encrypted with KMS.
Using AWS CLI:
To disable KMS encryption, run:
aws bedrock put-model-invocation-logging --model-id <MODEL_ID> --log-encryption-kms-key ""Verify that the KMS encryption has been disabled:
aws bedrock describe-model-invocation-logs --region <REGION>
