A prompt contains a customer's account number. How do you protect it?
Why B is the answer
Detect and mask it before the model call
Detecting and masking an account number before the call means the model never receives it.
In detail
- Mask it before the call, so the model never receives it.
- Comprehend can help detect it.
Use case
An illustrative scenario, not a real incident.
A support app finds an account number in a message, and it replaces it with a placeholder before calling the model.
See it in different ways
flowchart LR A["App in a private subnet"] --> B["VPC endpoint"] B --> C["Amazon Bedrock"] D["IAM policy"] --> C E["KMS key"] --> F["Data at rest"]
sequenceDiagram participant U as User participant I as IAM participant G as Guardrails participant M as Model participant L as CloudTrail U->>I: Is this caller allowed? I->>G: Filter the input G->>M: Safe prompt M-->>G: Output G-->>U: Filtered output I->>L: Records the call
flowchart LR S0["Message arrives"] --> S1["Detect sensitive data"] --> S2["Mask it"] --> S3["Call model"]
Key point: Mask before the model call.
Why the other options are wrong
- A. Move the application to a different AWS Region
- Region does not protect it.
- C. Ask the model not to remember the account number
- The model has already received it.
- D. Send the prompt twice so that one copy can be checked
- That exposes it twice.