[{"data":1,"prerenderedAt":236},["ShallowReactive",2],{"topic-page:\u002Fit\u002Faws\u002Faws-certified-ai-practitioner\u002Fai-security-compliance-governance\u002Faws-security-controls-and-shared-responsibility":3},{"topic":4,"category":193,"seo":197,"breadcrumbs":202,"prerequisites":212,"nextTopics":213,"relatedTopics":221},{"id":5,"slug":6,"title":7,"summary":8,"canonicalPath":9,"categoryPath":10,"difficulty":11,"targetAudience":12,"estimatedMinutes":13,"generatedAt":14,"publishedAt":14,"updatedAt":14,"reviewStatus":15,"tags":16,"expectedKnowledge":27,"learningGoal":30,"keyTerms":31,"blocks":105},"it-aws-aws-certified-ai-practitioner-ai-security-compliance-governance-aws-security-controls-and-shared-responsibility","aws-security-controls-and-shared-responsibility","AWSのAIセキュリティ制御と責任共有","AWSのAIセキュリティ制御と責任共有を、AIF-C01の公式objective 5.1.1に沿って、用語、判断順序、例、誤解修正で整理します。","\u002Fit\u002Faws\u002Faws-certified-ai-practitioner\u002Fai-security-compliance-governance\u002Faws-security-controls-and-shared-responsibility","\u002Fit\u002Faws\u002Faws-certified-ai-practitioner\u002Fai-security-compliance-governance","beginner","cert_candidate",6,"2026-08-06","ai_generated",[17,18,19,20,21,22,23,24,25,26],"AWS Certified AI Practitioner","AIF-C01","AIのセキュリティ・コンプライアンス・ガバナンス","責任共有モデル","IAM","暗号化","AWS PrivateLink","Amazon Macie","Bedrock AgentCore","Guardrails",[28,29],"AWSクラウドの基本用語を聞いたことがある","AIを使う業務例を日常的な言葉で考えられる","AWSのAIセキュリティ制御と責任共有について、試験で問われる違いと選択基準を説明し、短い業務例へ適用できる。",[32,40,44,50,54,57,60,64,68,72,77,81,85,89,93,97,101],{"id":33,"label":34,"shortDefinition":35,"supplement":36,"role":39},"aws-shared-responsibility-model","AWS責任共有モデル","AWSがクラウド自体の保護を担い、利用者がクラウド上のデータ・ID・設定・アプリなどを担う責任分担です。",{"kind":37,"text":38},"misconception","マネージドサービスでも、利用者側の権限やデータ設定の責任は残ります。","primary",{"id":41,"label":42,"shortDefinition":43,"role":39},"identity-and-access-management","AWS Identity and Access Management（IAM）","AWSリソースへ誰がどの操作を行えるかを、IDと認可で管理するサービスです。",{"id":45,"label":46,"shortDefinition":47,"supplement":48,"role":39},"encryption-at-rest","保存時の暗号化","保存されたデータを、鍵なしでは読めない形へ変換して保護することです。",{"kind":37,"text":49},"正規の権限による過剰アクセスは、暗号化だけでは防げません。",{"id":51,"label":52,"shortDefinition":53,"role":39},"encryption-in-transit","転送時の暗号化","ネットワークを移動するデータを暗号化し、盗聴や改ざんの危険を抑えることです。",{"id":55,"label":23,"shortDefinition":56,"role":39},"aws-privatelink","公開インターネットを経由せず、VPCから対応サービスへ私設接続するAWS機能です。",{"id":58,"label":24,"shortDefinition":59,"role":39},"amazon-macie","Amazon S3内の機密データを機械学習とパターン照合で発見・分類するAWSサービスです。",{"id":61,"label":62,"shortDefinition":63,"role":39},"amazon-bedrock-agentcore-identity","Amazon Bedrock AgentCore Identity","AIエージェントが利用者や外部サービスのIDを安全に扱うAmazon Bedrockの機能です。",{"id":65,"label":66,"shortDefinition":67,"role":39},"policy-in-agentcore","Policy in AgentCore","AIエージェントのツール利用を方針で許可・拒否するAmazon Bedrockの機能です。",{"id":69,"label":70,"shortDefinition":71,"role":39},"amazon-bedrock-guardrails","Amazon Bedrock Guardrails","生成AIの入力と出力へ、安全方針に沿う制御を適用するAmazon Bedrockの機能です。",{"id":73,"label":74,"shortDefinition":75,"role":76},"iam-role","IAMロール","人やアプリなどが引き受け、一時的な認証情報で権限を得るIAMのIDです。","contextual",{"id":78,"label":79,"shortDefinition":80,"role":76},"iam-policy","IAMポリシー","どの主体へ、どのリソースのどの操作を許可または拒否するかを記述する規則です。",{"id":82,"label":83,"shortDefinition":84,"role":76},"permission","権限","主体がリソースへ実行できる操作の範囲です。",{"id":86,"label":87,"shortDefinition":88,"role":76},"least-privilege","最小権限","目的に必要な操作だけを、必要な範囲と時間で許可する原則です。",{"id":90,"label":91,"shortDefinition":92,"role":76},"guardrail","ガードレール","AIの入力・出力・行動を、定めた安全方針の範囲へ制約する仕組みです。",{"id":94,"label":95,"shortDefinition":96,"role":76},"access-control","アクセス制御","認証された主体へ、許可されたデータや操作だけを利用させる仕組みです。",{"id":98,"label":99,"shortDefinition":100,"role":76},"audit-log","監査ログ","誰が何をいつ実行し、どの結果になったかを追跡できる記録です。",{"id":102,"label":103,"shortDefinition":104,"role":76},"aws-cloudtrail","AWS CloudTrail","AWSアカウントのAPI活動を記録し、操作主体・時刻・対象の追跡を支援するサービスです。",[106,111,122,131,140,146,152,158,174,183],{"id":107,"type":108,"title":7,"subtitle":109,"shortDefinition":110},"hero","HeroBlock","ID・権限、暗号化、ネットワーク、データ検出、ガードレールを重ねる","AWSがクラウド基盤のセキュリティを担い、利用者がクラウド上のデータ、ID、設定、アプリケーション等を担うという責任分担の考え方です。",{"id":112,"type":113,"term":34,"definition":114,"plainExplanation":115,"presentation":116,"supportLabel":117,"keywords":118},"definition","DefinitionBlock","[[cloze:aws-shared-responsibility-model|AWS責任共有モデル]]とは、AWSと利用者が守る範囲をサービスごとに分ける考え方です。","[[term:identity-and-access-management|AWS Identity and Access Management（IAM）]]で主体を識別し、[[term:encryption-at-rest|保存時の暗号化]]と[[term:encryption-in-transit|転送時の暗号化]]、[[term:aws-privatelink|AWS PrivateLink]]、[[term:amazon-macie|Amazon Macie]]を用途に合わせます。","natural","見分けるポイント",[119,120,121],"AWS管理範囲","利用者設定","多層防御",{"id":123,"type":124,"steps":125,"title":130},"decision-steps","StepBlock",[126,127,128,129],"人・アプリ・エージェントごとに[[term:iam-role|IAMロール]]を分け、[[term:iam-policy|IAMポリシー]]で必要な[[term:permission|権限]]だけを定める。","[[term:least-privilege|最小権限]]と[[term:access-control|アクセス制御]]で、データと操作の範囲を主体別に絞る。","[[term:amazon-bedrock-agentcore-identity|Amazon Bedrock AgentCore Identity]]と[[term:policy-in-agentcore|Policy in AgentCore]]でエージェントのIDとツール方針を分ける。","[[term:amazon-bedrock-guardrails|Amazon Bedrock Guardrails]]を[[term:guardrail|ガードレール]]の一層として配置し、他の制御と重ねる。","AIシステムを層で守る",{"id":132,"type":133,"title":134,"points":135,"body":139},"exam-cues","KeyPointBlock","判断で押さえる境界",[136,137,138],"責任共有はサービスごとに確認","IDと最小権限を主体別に設計","暗号化・私設接続・機密検出・ガードレールを多層化","[[term:audit-log|監査ログ]]は誰が何を行ったかを追跡し、[[term:aws-cloudtrail|AWS CloudTrail]]はAWS API活動の記録を支援します。暗号化やIAMだけへ依存せず、ID、ネットワーク、データ、入出力、監視を多層化します。",{"id":141,"type":142,"src":143,"alt":144,"caption":145},"diagram","DiagramBlock","\u002Fassets\u002Fit\u002Faws\u002Faws-certified-ai-practitioner\u002Fai-security-compliance-governance\u002Faws-security-controls-and-shared-responsibility\u002Faws-security-controls-and-shared-responsibility.svg","AWSのAIセキュリティ制御と責任共有についてIAM・AgentCore Identity、暗号化・PrivateLink、Macie・データ管理、Guardrails・ログ監視の関係を文字ラベルと矢印で示した図","AIアプリを四つの制御層で囲む図です。各層は異なる失敗を防ぎ、単独では全体を守れません。",{"id":147,"type":148,"scenario":149,"explanation":150,"result":151},"worked-example","ExampleBlock","Amazon Bedrockを使う社内要約アプリがS3の文書を参照します。","アプリ用ロールに対象バケットの読み取りだけを許可し、保存・転送を暗号化します。私設接続と機密検出、入出力制御、ログを重ねます。AWSが基盤を守っても、権限と文書選択は利用者が管理します。","責任共有を抽象論で終わらせず、制御と担当へ落とせます。",{"id":37,"type":153,"warningTitle":154,"message":155,"severity":156,"action":157},"WarningBlock","マネージドAIでも最小権限は必要","サービス側が基盤を管理しても、広すぎるIAM権限や誤ったデータ公開は利用者側の設定です。モデルAPI利用権限と参照データ権限を分けます。","warning","各データ経路について、主体、許可操作、暗号化、ネットワーク、ログを確認します。",{"id":159,"type":160,"title":161,"questions":162},"quiz","QuizBlock","AIF-C01 判断チェック",[163],{"question":164,"choices":165,"answerIndex":169,"choiceExplanations":170},"責任共有モデルに沿う設計はどれですか。",[166,167,168],"AWSの基盤責任と、利用者のIAM・データ・アプリ設定責任を分ける","Bedrock利用後はIAM設定が不要と考える","すべてのAIデータを公開バケットへ置く",0,[171,172,173],"正解です。責任を層とサービスで分けます。","利用者側の権限責任が残ります。","機密性と最小公開に反します。",{"id":175,"type":176,"title":177,"points":178},"summary","SummaryBlock","まとめ",[179,180,181,182],"AWSと利用者の責任をサービスごとに分ける","IAMとAgentCore系制御で主体を限定","暗号化・PrivateLink・Macieでデータを守る","Guardrails・検証・ログで入出力を監視",{"id":184,"type":185,"title":186,"nextTopics":187,"relatedKeywords":189},"next-action","NextActionBlock","次は「データ来歴・品質・アクセス・完全性」へ",[188],"it-aws-aws-certified-ai-practitioner-ai-security-compliance-governance-data-lineage-quality-access-and-integrity",[190,191,192],"データリネージ","データカタログ","出典引用",{"path":10,"title":19,"description":194,"parentPath":195,"accentToken":196},"AIシステムのアクセス制御、データ保護、脅威対策、根拠付け、統制と監査をAIF-C01の範囲で整理します。","\u002Fit\u002Faws\u002Faws-certified-ai-practitioner","cloud-amber",{"title":198,"description":199,"canonicalUrl":200,"ogImage":201},"AWSのAIセキュリティ制御と責任共有 | AWS Certified AI Practitioner","AIF-C01対策としてAWSのAIセキュリティ制御と責任共有の定義、判断軸、具体例、誤解しやすい境界を公式試験範囲に沿って学びます。","https:\u002F\u002Fzeqnilo.com\u002Fit\u002Faws\u002Faws-certified-ai-practitioner\u002Fai-security-compliance-governance\u002Faws-security-controls-and-shared-responsibility","https:\u002F\u002Fzeqnilo.com\u002Fassets\u002Fsite\u002Fdefault-og.svg",[203,206,209,210,211],{"title":204,"path":205},"IT","\u002Fit",{"title":207,"path":208},"AWS","\u002Fit\u002Faws",{"title":17,"path":195},{"title":19,"path":10},{"title":7,"path":9},[],[214],{"id":188,"title":215,"summary":216,"canonicalPath":217,"categoryPath":10,"categoryTitle":19,"difficulty":11,"targetAudience":12,"estimatedMinutes":13,"publishedAt":14,"updatedAt":14,"reviewStatus":15,"tags":218},"データ来歴・品質・アクセス・完全性","データ来歴・品質・アクセス・完全性を、AIF-C01の公式objective 5.1.2・5.1.3に沿って、用語、判断順序、例、誤解修正で整理します。","\u002Fit\u002Faws\u002Faws-certified-ai-practitioner\u002Fai-security-compliance-governance\u002Fdata-lineage-quality-access-and-integrity",[17,18,19,190,191,192,219,95,220],"データ品質","データ完全性",[222],{"id":223,"title":224,"summary":225,"canonicalPath":226,"categoryPath":227,"categoryTitle":228,"difficulty":11,"targetAudience":12,"estimatedMinutes":13,"publishedAt":14,"updatedAt":14,"reviewStatus":15,"tags":229},"it-aws-aws-certified-ai-practitioner-responsible-ai-safety-transparency-and-human-centered-design","安全性・透明性のトレードオフと人間中心設計","安全性・透明性のトレードオフと人間中心設計を、AIF-C01の公式objective 4.2.3・4.2.4に沿って、用語、判断順序、例、誤解修正で整理します。","\u002Fit\u002Faws\u002Faws-certified-ai-practitioner\u002Fresponsible-ai\u002Fsafety-transparency-and-human-centered-design","\u002Fit\u002Faws\u002Faws-certified-ai-practitioner\u002Fresponsible-ai","責任あるAI",[17,18,228,230,231,232,233,234,235],"安全性","透明性","解釈可能性","人間中心設計","利用者フィードバック","異議申立て",1787370539666]