Question

A healthcare company fine-tunes a custom foundation model on Amazon Bedrock using proprietary clinical data. Compliance requires that the resulting custom model artifacts be encrypted with a customer-managed key (CMK) so the security team can independently audit key usage and revoke access if a breach is suspected. During the fine-tuning job configuration, the engineer must ensure the model output is protected accordingly. Which action satisfies this requirement?

Accepted Answer

Specify a customer-managed AWS KMS key in the fine-tuning job's output configuration so the custom model artifacts are encrypted with the CMK.

Answer

Rely on the default AWS-owned key that Bedrock uses to encrypt all custom models, since encryption at rest is automatic.

Answer

Enable a Bedrock guardrail with PII masking on the training dataset to encrypt the model artifacts before storage.

Answer

Store the training data in an S3 bucket with SSE-KMS encryption, which automatically propagates the CMK to the trained custom model.