Category: Security, Identity, & Compliance

A distributed approach, one that brings generative AI to the data rather than the reverse, is achievable today using Amazon Web Services (AWS) solutions such as Amazon Bedrock for orchestration, Amazon Neptune for data lineage, and AWS Identity and Access Management (IAM) for source-point security enforcement.

Amazon Web Services (AWS) is collaborating with Expando, a Swedish defense technology company, to help European public sector organizations build exactly that kind of layered, resilient data infrastructure. Together, AWS and Expando offer a connected approach to data protection that spans rugged edge deployments, disconnected field operations, customer-owned secure locations, and the full power of the AWS Cloud.

This post explores how an agentic AI architecture on Amazon Web Services (AWS) modernizes the procurement lifecycle from solicitation to proposal evaluation while maintaining compliance with government regulations including United States of America FAR (Federal Acquisition Regulation),United States of America DFARS (Defense Federal Acquisition Regulation), and Canadian procurement frameworks (Public Service Procurement Canada (PSPC) /Shared Services Canada (SSC).

This post presents two complementary patterns for implementing per-user token guardrails on Amazon Bedrock from Amazon Web Services (AWS).

For the more than 2,800 administrators across approximately 1,200 participating institutions in the US, that means access to near daily provided to them through Amazon Quick Sight on Amazon Web Services (AWS) by the eduroam team at Internet2. However, this wasn’t always the case. This post walks through how the eduroam team modernized their data reporting pipeline, the architecture behind it, and the impact it’s had on institutional engagement.

Every major agent framework has a security model for this. Amazon Web Services (AWS), Microsoft, and Google each ship agent solutions with authentication and credential management built in. Amazon Bedrock Agents, for example, enforces AWS Identity and Access Management (IAM)-based authorization on which AWS Lambda functions, Amazon Simple Storage Service (Amazon S3) buckets, and Amazon Bedrock Knowledge Bases an agent might invoke.

As organisations modernise to meet the evolving expectations of the Australian Government, delivering secure, cloud-based services has become a commercial and operational necessity. This transformation brings a critical challenge: maintaining a hardened security posture while aligning to the Information Security Registered Assessors Program (IRAP) assessment requirements and priorities.

Catching a compliance violation in production is expensive. Catching it in a pull request is nearly free. In this post, we demonstrate how to build a multi-tool infrastructure as code (IaC) validation pipeline that checks AWS CloudFormation templates and Terraform configurations against Federal Risk and Authorization Management Program (FedRAMP) 20x Key Security Indicators (KSIs) before deployment. Combined with the preventive controls from Preventive controls for FedRAMP 20x: Using SCPs and guardrails to enforce KSIs and the methods to be described in future blog posts, this creates a full-lifecycle compliance architecture.

This post is for two audiences. The first is agencies already running MARS-E-compliant workloads on AWS that are looking to map their existing posture onto the new framework. The second is agencies planning a migration from on-premises infrastructure where ARC-AMPE will be in scope from the first day.

Learn how Somapa Information Technology PCL (SomapaIT), an AWS Partner, chooses Amazon Web Services (AWS) Cloud to implement DAC systems because of its global footprint, security, high availability, and scalability.