12. Security and Privacy

Security Architecture

graph TD
    subgraph "Perimeter"
        A[WAF] --> B[TLS 1.3]
        B --> C[API Gateway]
    end

    subgraph "Application"
        C --> D[IAM Roles<br>Least privilege]
        D --> E[Input Sanitization<br>Prompt injection defense]
        E --> F[Output Filtering<br>PII redaction]
    end

    subgraph "Data"
        F --> G[Encryption at Rest<br>KMS managed keys]
        G --> H[VPC Isolation<br>Private subnets]
        H --> I[Audit Logging<br>CloudTrail]
    end

User Data Protection

Data Classification

Data Retention

Access Control

Every service component has its own IAM role with minimum required permissions.

Orchestrator Role - dynamodb:GetItem, PutItem on the chatbot sessions table - bedrock:InvokeModel on specific model ARNs - sagemaker:InvokeEndpoint on the intent classifier - opensearch:ESHttpGet on the knowledge base index - No access to payment systems - No access to account settings - No write access to order or catalog systems

Frontend - Can execute API Gateway endpoints only - No direct access to backend services

Authentication Flow

sequenceDiagram
    participant User
    participant Frontend
    participant Gateway
    participant Auth

    User->>Frontend: Opens chat
    Frontend->>Gateway: Request with Amazon session cookie
    Gateway->>Auth: Validate session token
    Auth-->>Gateway: {customer_id: C123, is_prime: true}
    Gateway->>Gateway: Attach customer_id to request context
    Gateway-->>Frontend: WebSocket established

Guest users receive a temporary session ID. They can use product discovery, FAQ, and generic recommendations. Personalized recommendations and order tracking require authentication.

PII Handling

Input Sanitization

Before any user message reaches the LLM or analytics pipeline:

graph LR
    A[User Message] --> B[PII Detector]
    B --> C{PII found?}
    C -->|Email| D[Replace with [EMAIL]]
    C -->|Phone| E[Replace with [PHONE]]
    C -->|SSN| F[Replace with [REDACTED]]
    C -->|Credit Card| G[Replace with [REDACTED]]
    C -->|Address| H[Replace with [ADDRESS]]
    C -->|No PII| I[Pass through]
    D --> J[Sanitized Message]
    E --> J
    F --> J
    G --> J
    H --> J
    I --> J

This prevents personal data from reaching model logs or analytics.

Output Filtering

If the LLM generates PII from conversation context, the guardrails pipeline redacts it before the response is shown to the user.

Secure Logging

Access to logs containing user messages requires: 1. Security team approval. 2. Time-limited access. 3. Audit trail in CloudTrail.

Compliance Considerations

Model Safety and Content Moderation

Prompt Injection Defense

graph TD
    A[User Message] --> B[Input Validator]
    B --> C{Contains injection patterns?}
    C -->|Ignore previous instructions| D[Block and Log]
    C -->|You are now...| D
    C -->|Encoded or obfuscated attempts| D
    C -->|Clean| E[Process normally]
    D --> F[Return generic response]

Defenses: 1. System prompt is clearly separated from user input. 2. Input is scanned for known injection patterns. 3. The LLM is instructed never to follow instructions embedded in user messages that contradict the system prompt. 4. Output guardrails catch responses that deviate from expected behavior.

Content Moderation

Abuse Prevention