inflearn logo

AI Red Teaming 5 - The Attack Enabled by a Missing Setting

Review the AI service’s settings, including keys, access scope, call limits, execution permissions, guardrails, and logging. Compare the controls before and after while keeping other conditions unchanged, and review output handling to create the Mission 4-2 settings checklist and diagnostic record.

1 learners are taking this course

Level Intermediate

Course period Unlimited

Penetration Testing
Penetration Testing
AWS
AWS
aws-iam
aws-iam
AI
AI
LLM
LLM
Penetration Testing
Penetration Testing
AWS
AWS
aws-iam
aws-iam
AI
AI
LLM
LLM

What you will gain after the course

  • Read the roles handled by the service for the resources and values in the practice configuration file.

  • Distinguish the concepts of keys, access scope, rate limits, timeouts, budgets, permissions, guardrails, and logging, and link them to the corresponding rows in the checklist.

  • Match the test conditions before and after the guardrail, then compare the results, logs, and normal functionality.

  • Complete Mission 4-2 by entering the current value, observational evidence, and improvement suggestions in the eight-row checklist, including output processing.

Course Materials and Practice Guide

Course Introduction (0-1) Download the integrated student materials ZIP using the Download Materials button in the class. It includes the latest learning guide, the correction practice kit, existing mission templates, and evidence judgment examples with explanations. Also make use of the supplementary notes and examples from the relevant judgment lessons.

All previous lessons use AI-synthesized narration based on the instructor’s voice. The exercises use actual Amazon Bedrock models, while the tools and documents are simulated environments for educational purposes. No actual emails are sent or files deleted.

AWS usage charges are separate from the course fee and vary depending on the model, region, call volume, log retention, maintained resources, and free usage conditions. The costs presented in the course are estimated examples under specific conditions, and budget alerts do not automatically block usage. Check your usage after the hands-on exercises and clean up your resources.

Why this course?

In Intermediate 1, we opened up a single function call and the assembly function. The causes of real-world issues lie not only in the code but also in the configuration: APIs without keys, endpoints open to any origin, calls with no upper limit, roles that are broader than necessary, filters that haven’t been enabled, and logs that aren’t retained.

They are all determined outside the code, and they are also the areas most often overlooked during diagnosis.

This course covers those design units. You will turn each of the eight items off and on in your AWS stack one by one to observe what becomes accessible, then directly add Bedrock Guardrails and invocation logging to compare them and complete a configuration omission checklist.

What you’ll be able to do after this course

  • You can distinguish the three units—parameters, code, and design—and identify which layer a setting belongs to.

  • Read the four sections of `template.yaml` and identify which resources open what.

  • Observe key removal, calls to other origins, and proxy calls opened by unauthenticated APIs, and map them to OWASP LLM06.

  • Compare the states with throttling, timeouts, and budget alerts turned off and on to verify Unbounded Consumption.

  • Create and attach Bedrock Guardrails, then run the same attack three times with it disabled and three times with it enabled, comparing the blocking logs.

  • Enable invocation logging with a single setting and see for yourself that “without records, there is no reproduction.”

Recommended for people like these

  • Security practitioners who have directly observed prompt injection in Intermediate Level 1

  • Infrastructure and platform personnel who operate AI services and need to establish configuration inspection items

  • An assessor who has performed cloud configuration audits but does not know what changes in the AI stack.

  • Compliance professionals who need to substantiate the AI Framework Act and ISMS-P at the configuration level

This may not be suitable for those who:

  • Those looking to prepare for an AWS certification exam or take a general AWS security configuration course — this covers only eight items in a single hands-on stack.

  • Those who cannot change the practice stack — the exercises involve directly turning configuration values off and on, so you need your own stack that you set up in Beginner 1.

  • Those who skipped Mission 4 (the diagnostic worksheet) in Intermediate 1 — the checklist uses the same assessment language as that worksheet.

  • Those expecting payloads or bypass techniques—we do not cover them here either.

Course Flow - Define Configuration Units → Toggle Items On and Off → Compare Guardrails and Logging → Checklist

11 sessions in total. The section order is the learning order.

  • Section 1 · Course Introduction (1 lesson · 1 preview lesson)

  • Section 2 · Configuration Units – Keys · Limits · Permissions (4 lessons · 1 preview)

  • Section 3 · Hands-on Practice · Guardrails · Logging · Output (3 lessons)

  • Section 4 · Checklist and Summary (3 lessons)

Things to Check Before Taking the Course

  • Hands-on practice requires your own AWS account and a registered payment method. Use the stack you uploaded in Basics 1 as-is; if you deleted it, the procedure for uploading it again from the materials archive zip is provided in README_AWS inside the zip.

  • AWS accounts can only be created by individuals aged 18 or older. Middle and high school students should use a guardian’s account for the exercises.

  • The cost of the AWS exercises varies depending on the model, region, number of calls, guardrails, log retention, resources kept running, and free-tier conditions. The amounts stated in the course are estimated examples under specific conditions and do not guarantee a spending limit. Budget alerts do not automatically block usage, so check your usage and clean up resources after the exercises.

  • Nothing is installed on your PC. We only use the Chrome or Edge browser and the AWS Console. Safari is not supported.

  • Some of the AWS Console scenes shown in the hands-on exercise are diagrams illustrating the procedure rather than actual screens. The menu names and order are the same.

  • The narration is AI-synthesized using the instructor’s voice.

Detailed lecture content

What Is a Design Unit?

This course covers design units. If a parameter is one line of invocation and code is a single function, then design is the stack and console that surround that function. In the first lesson, we distinguish the three units, and from then on, we turn the eight items off and on one by one.

Configuration Units - Keys · Limits · Permissions

1-1 is where the settings live. We read the four sections of template.yaml and identify which resources open what. 1-2 is about keys and doors. We remove the key and make three calls, call it from another origin, and observe the proxy call enabled by an unauthenticated API. 1-3 is about limits and budgets. We compare the states with and without a limit of 2 requests per second and a burst of 5, a 60-second Lambda timeout, and an 80% budget alert. 1-4 is about permissions.

Using IAM roles, we verify how the difference between least privilege and administrative privileges directly becomes the attack surface, connecting it all the way to Article 34, Paragraph 1, Item 4 of the AI Framework Act.

Hands-on practice · Guardrails · Logging · Output

1-5 is the core of this lecture. You will create and attach Bedrock Guardrails yourself, then run the same attack three times with the guardrail off and three times with it on to see what changes. The blocking stage appears in the screen logs, and the response indicates whether intervention occurred, making the comparison visible. 1-6 covers logging.

Call logging is controlled by a single stack parameter, so when it is turned off, there is no trace in CloudWatch; when it is turned on and the stack is updated, one line is left for each call. It would be difficult to demonstrate more clearly that without records, there is no reproducibility. 1-7 is the output. The model’s response flows into one of four destinations—the browser, shell, database, or next prompt—but it is the code that receives and forwards it, not the model, that knows the destination.

Checklist and Summary

In the final three sessions, use the concept-to-form mapping table to group the budget and timeouts, complete the eight-row checklist including output handling, and submit Mission 4-2. Then add the configuration layer on top of the five control layers established in Intermediate 1. That layer leads into the eight layers of the Advanced level.

Attach the supporting basis to each item as well. OWASP LLM Top 10 numbers are included, the relevant provisions of Article 34 of the AI Basic Act are included for permissions and logging, and ISMS-P certification criteria numbers are included for the checklist items. When transferring diagnostic results into a report, the most time-consuming task is finding and attaching the supporting basis. If you write it down at the moment you make the observation, that time almost disappears. That is why the last two of the checklist’s six columns are for the supporting basis and rollback confirmation.

Structure and Learning Method

The course consists of 11 sessions, including two hands-on sessions. Since the exercises involve changing configuration values, we follow one principle: make changes only in your own stack, and restore or delete them when finished. Payloads and bypass techniques are not included here either.

Course Features

  • Toggle each of the eight design units off and on once, and directly observe what becomes accessible.

  • Create and attach Bedrock Guardrails, then disable the same attack and enable it three times, comparing the results.

  • Because call logging is a stack parameter, you experience firsthand that “changing a single setting leaves a record.”

  • Each item is supported by an OWASP LLM number and an article of the AI Basic Act.

  • Areas covered - AI security configuration from a penetration testing and offensive security perspective, LLM guardrails and logging, and AWS IAM (aws-iam) permissions

Upon completing the course

Once you complete the course, an eight-row checklist for missing configurations remains filled out, along with reference numbers (OWASP LLM · AI Basic Act · ISMS-P), and a configuration layer is added on top of the five control layers from Intermediate 1. That layer leads into the eight layers of the Advanced course.

Series “AI Red Teaming by Breaking In Yourself” — Lesson 7

  • AI Red Teaming 1 - Introduction to LLM Security and Hands-on Environment

  • AI Red Teaming 2 - How LLMs Work and the Attack Surface

  • AI Red Teaming 3 - Red Team Operations and Threat Modeling

  • AI Red Teaming 4 - Breaking Through Prompt Injection Directly

  • AI Red Teaming 5 - The Attack Unlocked by One Missing Setting ← This lecture

  • AI Red Teaming 6 - Breaking Through Agents and RAG

  • AI Red Teaming 7 - Control Design and Red Team Report

The structure is designed so that the mission deliverables from one lecture become the material for the next, so the lectures are released in numerical order, with unreleased lectures being published sequentially.

Recommended for
these people

Who is this course right for?

  • Security and platform personnel who need to establish cloud configuration review criteria for AI services

  • Developers and diagnosticians seeking to explain the effects of applying guardrails and the controls that were omitted.

Need to know before starting?

  • Experience writing Mission 4 diagnostic records from Lesson 4 and the practice environment from Lesson 1 are required. Use the hands-on kit that includes guardrails and call logging; costs may be incurred according to AWS usage conditions. Also use the concept–checklist cross-reference table in the learning guide.

Hello
This is rmsxodxod1289

Career Verified

I am a practitioner who started with penetration testing and builds information security management systems.

I handle annual security assessments of infrastructure, web, and applications for automotive manufacturers and energy companies.

I assessed them layer by layer and handled the same client’s ISMS-P certification through three rounds: initial, follow-up, and renewal.

I responded by independently carrying out the technical safeguards component.

Currently, as the information security officer in a one-person team, I am preparing for initial certification while establishing AI security governance.

I am designing the framework. Since this is an area where standards are still being established, starting with defining the scope of controls themselves,

It is a position where I must establish them myself.

I hold certifications as an Engineer Information Security, CPPG, and ISO/IEC 27001 Auditor, and at Dongguk University’s International Information Security Department,

I am researching leakage paths in AI environments and comparing them against authentication criteria in the Graduate School’s Department of Artificial Intelligence Security.

5 years and 9 months of experience. Client names and vulnerabilities actually discovered are subject to confidentiality, so in lectures

do not cover them in lectures.

More

Curriculum

All

11 lectures ∙ (1hr 20min)

Course Materials:

Lecture resources
Published: 
Last updated: 

Reviews

Not enough reviews.
Please write a valuable review that helps everyone!

rmsxodxod1289's other courses

Check out other courses by the instructor!

Similar courses

Explore other courses in the same field!

Limited time deal

$12.10

67%

$37.40