Is the AWS Bedrock Academy free?

Yes. The full course is free and includes 25 modules, 52 lessons, 16 labs, and quiz-based progression with no sign-up required.

How is Infinity AWS Bedrock Academy different from AWS Skill Builder?

Unlike AWS Skill Builder which often gates advanced hands-on labs behind paid subscriptions or AWS Builder ID logins, Infinity Tech Stack's AWS Bedrock Academy is 100% free, ungated, and browser-first with zero sign-up required. It includes 25 modules, 52 lessons, 16 hands-on labs, and 125+ quiz checks covering the Converse API, Bedrock Guardrails, AgentCore, and multi-model evaluations without requiring active AWS account credentials.

Who is this course for?

Developers, architects, and platform teams building AI systems on AWS Bedrock from MVP to production scale.

What does this Bedrock course cover?

The academy covers runtime inference, prompt engineering, guardrails, knowledge bases, agents, evaluation, observability, security, compliance, resilience, incident response, and production launch discipline.

Threat modeling helps teams:

Prioritize high-risk failure paths before incidents — Threat models surface high-impact risks early so controls can be designed proactively.

Network Isolation and Encryption Tutorial | Security and Data Protection

← Back to Dashboard

1. Data Classification and Prompt Hygiene2. Network Isolation and Encryption

Network Isolation and Encryption

📚 Security and Data Protection⏱ 10 min⭐ 100 XP⌨ Hands-on lab

Secure-by-Design Integration

Secure Bedrock apps by combining IAM least privilege, encryption in transit/at rest, network boundaries, and auditable operations. No single control carries the design - each layer assumes the one before it can fail.

Network Boundary: Keep Traffic Off the Public Internet

VPC interface endpoints (AWS PrivateLink) - create endpoints for bedrock-runtime (and bedrock control plane) so workloads in private subnets invoke models without NAT or public egress.
Endpoint policies - restrict which principals and which Bedrock actions may transit the endpoint - a second authorization layer independent of the caller's IAM.
Egress lockdown - with PrivateLink in place, security groups can deny general internet egress from AI service subnets entirely.

Encryption Posture

Surface	Default	Hardening option
In transit	TLS on all Bedrock APIs	Enforce TLS 1.2+ via endpoint/SDK policy
At rest (service data)	AWS-managed encryption	Customer-managed KMS keys (CMK) for Guardrails, Knowledge Bases, customization artifacts, invocation logs
Your stores (S3, vector DB, logs)	Your responsibility	CMK + bucket policies + access logging

The Layered Model, End to End

identity   → least-privilege roles, scoped to pinned model ARNs
network    → PrivateLink endpoints + endpoint policies, no public egress
data       → classification, masking, CMK encryption at rest
runtime    → Guardrails on input/output, tool authorization server-side
audit      → CloudTrail + invocation logging + trace correlation

Assume every integration could fail and design containment paths: a leaked app credential should hit the endpoint policy wall; a compromised subnet should have no route to exfiltrate; a poisoned prompt should meet guardrails and scoped tools.

Threat-model the AI specifics too: prompt injection → tool misuse, retrieval poisoning via writable corpora, and sensitive-data echo in responses. Classic network security does not cover these three - your guardrail + tool-authorization design does.

⌨ HANDS-ON LABThreat Model an AI Endpoint

⭐ +150 XP

Create a concise threat model for Bedrock-connected application boundaries.

1List assets, threats, and controls.

2Define top 3 mitigations.

lab-sandbox — simulated environment

INFINITY LAB SANDBOX v2.6 — simulated shell
Type the command for the current objective. Helpers: "hint", "solution", "clear".
$

OBJECTIVE 1 / 2 — type "hint" if stuck

🧪 Knowledge Check

Press 1-4 to select1 of 2

Which approach best reflects production AI security?

Single control only

Layered controls across identity, data, and network

No encryption

No audit logs