A model returns JSON that is passed to an order API.
Check required fields, types, allowed values, and user authorization.
Choose two required controls.
Treat model output as untrusted input: validate the schema and business values, and re-check authorization on the server.
Detailed explanation
Reject malformed or out-of-range output before it reaches the downstream API.
Reject malformed or out-of-range output before it reaches the downstream API.
Do not use model output as the sole authorization decision.
Do not use model output as the sole authorization decision.
This creates injection and unauthorized-operation risks.
This creates injection and unauthorized-operation risks.
Presentation cannot validate type, values, or authorization.
Presentation cannot validate type, values, or authorization.
Try it yourself
An example you can run in a temporary verification environment.
AWS公式AIF-C01ガイドのDomain 3.4とAWSセキュリティ設計の入力検証を確認する。Expected result
モデル出力を認可判断やSQLへ直接使わず、サーバー側検証を行う理由を説明できる。Key points
- Schema validation
- Authorization
- Trust boundary
Notes
- Environment: AWS公式AIF-C01試験ガイドとAWS公式ドキュメントの確認
- Command output formatting can vary slightly by distribution or tool version.
- Run the example in a temporary directory or process when possible.
Foundation review
Read the scope first
Check whether the command acts on the current shell, a new process, an existing process, or a file.
Verify the observable result
Use the supplied command and compare the output with the expected result.