Introduction
Candidates preparing for the AWS Certified AI Practitioner (AIF-C01) exam usually spend most of their time on the generative-AI and machine-learning content — foundation models, prompt engineering, and the AWS AI services. That focus makes sense, but it leaves a domain that is easy to underestimate and easy to score well on: Security, Compliance, and Governance for AI Solutions, which carries roughly 14% of the exam.
This domain is where AI meets the discipline that AWS has always tested — access control, encryption, auditing, and compliance — reframed for the era of foundation models and machine learning pipelines. It is also frequently confused with the Responsible AI domain. They are different: Responsible AI (Domain 4) is about bias, fairness, explainability, and safety, while Security, Compliance & Governance (Domain 5) is about who can access what, how data is protected, how you prove it in an audit, and how you stay compliant with regulations. If you want the Responsible AI side, our Responsible AI on AWS guide covers it in depth; this article stays firmly on security, compliance, and governance.
This guide walks Domain 5 the way the AIF-C01 blueprint frames it. If you want the full exam picture first, start with the AWS AI Practitioner Exam Guide 2026 and the domain-by-domain AIF-C01 Domains Breakdown, then come back here to go deep.
What Domain 5 Covers
The blueprint organizes this domain into three connected ideas. Keep the whole map in view before diving in:
| Sub-topic | What the exam expects you to know |
|---|---|
| Securing AI systems | Shared responsibility, IAM/least privilege, encryption, network isolation, Bedrock & SageMaker security features |
| Governance & oversight | Model transparency, data lineage, versioning, SageMaker governance tools, MLOps controls |
| Compliance & auditing | AWS compliance programs, AWS Artifact, monitoring and audit trails (CloudTrail, Model Monitor) |
You are not expected to configure IAM policies or KMS keys by hand — AIF-C01 is a conceptual, multiple-choice exam. The questions test whether you know which service or control solves a given security, governance, or compliance problem. Keep that altitude in mind as we go.
The Shared Responsibility Model for AI
Every AWS security conversation starts here, and AI is no exception. AWS secures the infrastructure and the managed services — the “security of the cloud.” You, the customer, secure your data, your access controls, and your configurations — the “security in the cloud.”
For AI workloads this splits cleanly:
| AWS is responsible for | You are responsible for |
|---|---|
| Physical infrastructure, hypervisors, managed service availability | Which IAM identities can call the model |
| Patching and operating Bedrock/SageMaker managed components | Encrypting and classifying your training and prompt data |
| Isolation between tenants of managed services | Configuring VPC endpoints, guardrails, and logging |
The exam-worthy takeaway: the model provider and AWS secure the platform, but protecting the data you send to a model and controlling who can invoke it is always your responsibility. A common trap answer implies “the managed service handles all security for me” — it does not.
Securing AI Systems: Access Control and Least Privilege
Access to every AWS AI service is gated by AWS Identity and Access Management (IAM). The principle the exam rewards is least privilege — grant only the permissions an identity actually needs.
Key ideas for AIF-C01:
- IAM policies and roles control who can invoke a model (
bedrock:InvokeModel), create a training job, or read a dataset. Prefer roles for applications and services over long-lived access keys. - Service roles let SageMaker or Bedrock act on your behalf (for example, reading training data from S3) with scoped permissions.
- Resource-based controls and VPC endpoint policies further restrict where calls can originate.
If a question asks how to stop an application from calling a foundation model it should not use, the answer is almost always an IAM policy scoped to the specific model or action — not a network change or a guardrail.
Data Protection: Encryption and Network Isolation
Protecting data is the heart of AI security, because AI systems are only as trustworthy as the data pipelines feeding them.
Encryption:
- In transit — traffic to Bedrock and SageMaker uses TLS by default.
- At rest — training data, model artifacts, and outputs are encrypted, and you can use AWS KMS customer managed keys (CMKs) for control over key rotation and access.
Network isolation:
- VPC endpoints powered by AWS PrivateLink keep traffic between your applications and Bedrock/SageMaker on the AWS private network, off the public internet.
- SageMaker VPC mode / network isolation runs training and inference without internet access when required by policy.
Amazon Bedrock data handling is a favorite exam point. Remember these facts:
- Your prompts and completions are not used to train the base foundation models and are not shared with model providers.
- Data you use to fine-tune or customize a model stays in your AWS account, encrypted, and the customized model is private to you.
- You can attach KMS keys and reach Bedrock over PrivateLink for stricter data controls.
For deeper Bedrock context beyond security, our Amazon Bedrock for AWS AI Practitioner guide covers the full service; here the point is that your data stays yours and stays encrypted.
Finally, Amazon Macie can discover and classify sensitive data (like PII) in S3 — useful for governing what actually lands in your training datasets.
Securing Foundation Models and Prompts
Generative AI introduces risks beyond classic data security. AIF-C01 expects awareness of a few:
- Prompt injection — malicious input that tries to override system instructions. Mitigate with input validation and content filtering.
- Sensitive data leakage — a model repeating confidential data in an output. Mitigate with data minimization and output filtering.
- Amazon Bedrock Guardrails — configurable filters that block denied topics, filter harmful content, redact PII, and apply contextual grounding checks to reduce hallucinations.
Note the overlap with Responsible AI: Guardrails serve both safety (Domain 4) and security/governance (Domain 5). On the exam, if the scenario is about blocking harmful or off-limits content or redacting PII from model interactions, Bedrock Guardrails is the answer.
Governance and Model Oversight
Governance is about maintaining visibility and control over models throughout their lifecycle — knowing what a model is, what data trained it, who approved it, and whether it still behaves as expected. AWS provides purpose-built tools:
| Capability | AWS tool | What it gives you |
|---|---|---|
| Model documentation & transparency | SageMaker Model Cards | Record intended use, risk rating, training details, and evaluation results |
| Version control & approval workflow | SageMaker Model Registry | Catalog model versions with approval status for promotion to production |
| Access governance | SageMaker Role Manager | Build scoped IAM roles for ML personas quickly |
| Fleet-wide oversight | SageMaker Model Dashboard | Central view of deployed models, monitoring, and alerts |
| Bias & explainability | SageMaker Clarify | Detect bias and explain feature importance (also a Responsible AI tool) |
Two governance ideas worth memorizing: data lineage (tracking where training data came from and how it was transformed) and model versioning (so you can reproduce, audit, and roll back). Governance answers the auditor’s question: “Prove which model made this decision and what it was trained on.”
Monitoring, Logging, and Auditing
Compliance is impossible without an audit trail. The AIF-C01 expects you to map the right monitoring service to the right need:
| Need | Service | What it does |
|---|---|---|
| Who called which API, and when | AWS CloudTrail | Records API activity for audit and forensics |
| Operational metrics, logs, alarms | Amazon CloudWatch | Metrics, logs, dashboards, and alarms for AI workloads |
| Detect model/data drift over time | SageMaker Model Monitor | Watches data quality, model quality, bias drift, and feature-attribution drift |
| Track resource configuration & compliance | AWS Config | Records config changes and evaluates them against rules |
The most testable pairing: CloudTrail = “who did what” (audit trail), while CloudWatch = “how is it performing” (metrics and logs). And Model Monitor is the AI-specific tool for catching drift — when live data or model behavior diverges from the training baseline.
Compliance and Regulatory Alignment
Finally, the compliance layer. Organizations in regulated industries must demonstrate that their AI systems meet standards such as GDPR, HIPAA, SOC, ISO, and PCI DSS. AWS supports this through:
- AWS compliance programs — AWS services (including Bedrock and SageMaker) are covered by a broad set of third-party attestations and certifications.
- AWS Artifact — the self-service portal to download AWS compliance reports (SOC, ISO, PCI) and accept agreements. If a question asks where you get AWS audit/compliance documentation, the answer is AWS Artifact.
- Shared responsibility, again — AWS certifies the platform; you remain responsible for how you use it compliantly (data residency, retention, consent, and access).
The exam framing: compliance is a partnership. AWS gives you certified, auditable infrastructure and the evidence to prove it (via Artifact), but configuring your AI workload to meet a regulation — encryption, access control, logging, data handling — is your job.
Putting It Together: A Domain 5 Cheat Sheet
When a scenario question appears, map the problem to the control:
| Problem in the scenario | The Domain 5 answer |
|---|---|
| Restrict who can invoke a model | IAM policy / least privilege |
| Encrypt training data with your own keys | AWS KMS customer managed keys |
| Keep model traffic off the public internet | VPC endpoints / AWS PrivateLink |
| Block harmful content or redact PII in prompts | Amazon Bedrock Guardrails |
| Prove who called an API for an audit | AWS CloudTrail |
| Detect that a model’s inputs have drifted | SageMaker Model Monitor |
| Document a model’s intended use and risks | SageMaker Model Cards |
| Download AWS compliance/audit reports | AWS Artifact |
| Discover PII in an S3 training bucket | Amazon Macie |
If you can answer that column from memory, you have this domain.
Study Strategy for This Domain
Domain 5 is 14% of the exam and rewards service-to-purpose mapping more than deep theory:
- Internalize the shared responsibility model for AI — it underpins many questions.
- Drill the service cheat sheet above until each pairing is automatic.
- Separate Domain 4 from Domain 5 — bias/fairness/explainability is Responsible AI; access/encryption/audit/compliance is this domain. Guardrails and Clarify straddle both.
- Memorize the Bedrock data-privacy facts — your data is not used to train base models and stays in your account.
Reading builds the map, but AIF-C01 rewards fast recognition of the right service for a scenario. The most reliable way to surface gaps is to answer realistic, exam-style questions and study the explanations. Our free AWS AI Practitioner practice questions are a solid warm-up, and when you want full-length, timed practice across all five domains, the AWS Certified AI Practitioner Mock Exam Bundle gives you structured mock exams with detailed explanations so you know exactly where you stand before exam day.
Pair this with the AWS AI Practitioner Study Plan to sequence the whole exam, and revisit the AI & ML Fundamentals guide if the underlying ML concepts feel shaky. If you want to go deeper on cloud security patterns generally, the AWS Security Specialty IAM Deep Dive is a strong next read.
Conclusion
Security, Compliance, and Governance for AI is the domain where AWS’s classic disciplines — IAM, encryption, auditing, compliance — meet the new world of foundation models and ML pipelines. The through-line is the shared responsibility model: AWS secures and certifies the platform, but protecting your data, controlling access, keeping an audit trail, and meeting regulations are your responsibility.
Learn the service-to-problem mappings — IAM for access, KMS for encryption, PrivateLink for isolation, Guardrails for content control, CloudTrail for audit, Model Monitor for drift, Model Cards for transparency, and Artifact for compliance evidence — and roughly 14% of the AIF-C01 becomes reliable points. Combine that with timed practice, and Domain 5 turns from an afterthought into one of the most predictable sections of your exam.
FAQ
How much of the AWS AI Practitioner exam is Security, Compliance, and Governance?
Domain 5 (Security, Compliance, and Governance for AI Solutions) is roughly 14% of the AIF-C01 exam — a meaningful, scoreable chunk that many candidates under-prepare.
What is the difference between Domain 4 and Domain 5 on the AIF-C01?
Domain 4 (Responsible AI) is about bias, fairness, transparency, explainability, and safety. Domain 5 (Security, Compliance & Governance) is about access control, data protection, monitoring, auditing, and regulatory compliance. Some tools — like Bedrock Guardrails and SageMaker Clarify — support both domains.
Is my data used to train Amazon Bedrock’s foundation models?
No. Prompts and completions you send to Amazon Bedrock are not used to train the base foundation models and are not shared with the model providers. Data used to fine-tune a model stays in your AWS account, encrypted, and the customized model is private to you.
What is the difference between AWS CloudTrail and Amazon CloudWatch for AI workloads?
CloudTrail records who called which API and when — it is your audit trail. CloudWatch collects metrics, logs, and alarms about how your workloads are performing. For a “who did what” audit question, choose CloudTrail; for operational monitoring and alerting, choose CloudWatch.
Which AWS service provides compliance and audit reports?
AWS Artifact is the self-service portal for downloading AWS compliance reports (such as SOC, ISO, and PCI DSS) and accepting agreements. AWS services like Bedrock and SageMaker are covered under AWS’s compliance programs, and Artifact is where you obtain the supporting documentation.
What does SageMaker Model Monitor do?
SageMaker Model Monitor continuously watches deployed models for drift — including data-quality drift, model-quality degradation, bias drift, and feature-attribution drift — and can raise alerts when live behavior diverges from the training baseline, which is central to ongoing AI governance and oversight.