Protecting PII and sensitive data (Guardrails sensitive info filters, Macie, Comprehend): AIP-C01 study notes and practice questions

What to know for the exam

AIP-C01 asks where personal data can leak in a generative system: user input, model output, source documents, training data and logs. Each leak point has its own control, and the exam expects you to match the control to the place where the data appears.

Guardrail sensitive information filters

Bedrock Guardrails sensitive information filters detect predefined PII entities, such as names, addresses, email addresses, phone numbers and account numbers, and custom regular expressions for formats your company uses, such as employee IDs. Each entity has an action:

• Block rejects the request or response.
• Mask (anonymize) replaces the value with a placeholder and lets the rest of the exchange continue.

Filters apply to input and output. Use mask when the user still needs an answer, and block when the data must never appear. See sensitive information filters.

Finding PII before ingestion

Amazon Macie scans Amazon S3 buckets and reports sensitive data it finds, including PII. Run it before a knowledge base sync, then remove the data, restrict the bucket or exclude the documents. Macie checks stored data, not live prompts, so it complements the guardrail rather than replacing it.

Redacting training data

Before fine-tuning, use Amazon Comprehend PII detection to find and redact personal data in training text. Keep the original data in restricted storage with its own access controls, and train only on the redacted copy.

Retention and data handling

Bedrock does not use your prompts or outputs to train models and does not share them with model providers. Your own stored copies are still your responsibility. Use S3 lifecycle rules to expire invocation logs and stored prompts automatically, and encrypt them with KMS. Pick a geographic cross-Region inference profile when data must stay within one geography. See data protection in Amazon Bedrock.

Logging hygiene

Redact personal data before it reaches application logs. Enable model invocation logging only where needed, and restrict who can read those logs. Logging raw input while masking the output still exposes the data.

How to choose

Common traps

• Assuming Bedrock trains on your prompts. It does not.
• Writing regex in application code and expecting it to catch every name or address. Use the guardrail’s managed PII entities.
• Using Macie for live traffic. Macie scans stored data, not model calls.
• Masking the answer but logging the unmasked prompt.
• Keeping training data forever because it is redacted once. Keep the originals restricted and audited.

See also Audit and traceability.

Try the 1 practice question ↓