Is the AWS Bedrock Academy free?

Yes. The full course is free and includes 25 modules, 52 lessons, 16 labs, and quiz-based progression with no sign-up required.

How is Infinity AWS Bedrock Academy different from AWS Skill Builder?

Unlike AWS Skill Builder which often gates advanced hands-on labs behind paid subscriptions or AWS Builder ID logins, Infinity Tech Stack's AWS Bedrock Academy is 100% free, ungated, and browser-first with zero sign-up required. It includes 25 modules, 52 lessons, 16 hands-on labs, and 125+ quiz checks covering the Converse API, Bedrock Guardrails, AgentCore, and multi-model evaluations without requiring active AWS account credentials.

Who is this course for?

Developers, architects, and platform teams building AI systems on AWS Bedrock from MVP to production scale.

What does this Bedrock course cover?

The academy covers runtime inference, prompt engineering, guardrails, knowledge bases, agents, evaluation, observability, security, compliance, resilience, incident response, and production launch discipline.

Why classify prompt fields?

To apply handling controls based on sensitivity — Classification enables enforceable protection controls.

Data Classification and Prompt Hygiene Tutorial | Security and Data Protection

← Back to Dashboard

1. Data Classification and Prompt Hygiene2. Network Isolation and Encryption

Data Classification and Prompt Hygiene

📚 Security and Data Protection⏱ 10 min⭐ 100 XP

Do Not Send Secrets by Default

Classify request fields and strip unnecessary sensitive data before inference. Every token you send to a model is a token that transits your telemetry, your invocation logs, and - if you enabled full logging - your S3 buckets. Data minimization at the prompt boundary shrinks every downstream risk at once.

Classify, Then Decide Handling

Class	Examples	Prompt policy
Public	Docs, product names	Send freely
Internal	Ticket text, runbook content	Send if needed; keep out of third-party analytics
Confidential	Customer names, emails, account IDs	Mask or tokenise before inference where the task allows
Restricted	Credentials, keys, card/health data	Never in a prompt - strip at the boundary, alert on detection

Deterministic Masking Preserves Utility

# Before inference
"Customer jane.doe@acme.com (account 8842-19) reports card declined"
→ "Customer [EMAIL_1] (account [ACCT_1]) reports card declined"

# Model answers using placeholders → rehydrate after response
"Contact [EMAIL_1] to confirm the retry succeeded"
→ "Contact jane.doe@acme.com to confirm the retry succeeded"

Deterministic tokens (same input → same placeholder) keep multi-turn coherence and let you trace entities without exposing them. Bedrock Guardrails' sensitive information filters add a managed detection layer (PII types + custom regex, block or mask) - use both: your masking as primary, Guardrails as the safety net.

Redact credentials and personal identifiers where possible - secrets have zero legitimate reason to reach a model.
Use deterministic masking for traceability.
Separate business context from sensitive raw records - send the derived signal ("payment failed twice"), not the raw record.

Audit trick: run a PII detector over a sample of your own invocation logs. Whatever it finds is what you're already leaking into prompts today - fix the top offenders at the field level.

🧪 Knowledge Check

Press 1-4 to select1 of 2

A strong prompt hygiene practice is:

Include full raw records always

Redact/minimize sensitive data before inference

Disable logs globally

Share root credentials