3.3.3 · Lesson 11 of 15
Compliance Control Mapping
Map GenAI technical controls to policy and regulatory requirements so audits can prove which AWS capabilities satisfy each obligation.
WHAT
Map GenAI safety, security, and governance controls to organizational policy and regulatory needs.
HOW
| Requirement | Control |
|---|---|
| No public internet for FM calls | Interface VPC Endpoints (PrivateLink) |
| Customer-controlled encryption | KMS CMKs |
| Topic / content bans | Bedrock Guardrails Denied Topics / filters |
| Prompt/completion audit | Bedrock Model Invocation Logging |
| Dataset lineage & access | Glue Data Catalog + Lake Formation |
| Model documentation | SageMaker Model Cards |
EXAM FOCUS
Exam scenarios often list multiple regulatory constraints — pick the combination of controls that maps 1:1 to each constraint.
Key points
- Map controls to regulations
- PrivateLink / CMK / Guardrails / logging as evidence
- Ownership and approval workflows
- Lake Formation for data policy
- Audit-ready control inventories
Exam focus
Map each regulatory requirement to a concrete AWS control (e.g., no public internet → PrivateLink; customer-controlled keys → KMS CMKs; topic bans → Denied Topics).