An AI app calls an external API and AWS services.
Keep keys and tokens out of source code and prompts.
Choose two appropriate designs.
Use roles or a secret manager and mask secrets in prompts, logs, and errors.
Detailed explanation
Long-lived keys need not be embedded in code or user input.
Long-lived keys need not be embedded in code or user input.
This reduces accidental exposure through the model and operations.
This reduces accidental exposure through the model and operations.
The key could be exposed through output or logs.
The key could be exposed through output or logs.
Protection, access control, and rotation are still required.
Protection, access control, and rotation are still required.
Try it yourself
An example you can run in a temporary verification environment.
AWS公式Secrets Manager・IAMとAIF-C01 Domain 5.1のAIセキュリティを確認する。Expected result
秘密情報をモデル入力やソースコードから分離する設計を説明できる。Key points
- Secrets Manager
- Roles
- Masking
Notes
- Environment: AWS公式AIF-C01試験ガイドとAWS公式ドキュメントの確認
- Command output formatting can vary slightly by distribution or tool version.
- Run the example in a temporary directory or process when possible.
Foundation review
Read the scope first
Check whether the command acts on the current shell, a new process, an existing process, or a file.
Verify the observable result
Use the supplied command and compare the output with the expected result.