AWS AI Services
AWS · 123456789012 Amazon Web Services · Cloud AI platform · CloudTrail eventSource comprehend.amazonaws.com
Policy · none set
Policy changes re-score this app on the next sync, which starts right away.
Finding · Open
Risk score
48
Medium
People
2
IAM identities in CloudTrail
CloudTrail events
35
3 write · 0 denied · 90 days
First seen
Aug 25, 2026
Last seen 19 h ago
awsaccount:123456789012builders
Next steps
Recommended actions
- 01AWS AI Services trains on data unless a business tier or opt-out is used. Verify which tier these users are on.
- 02Set the AI services opt-out policy in AWS Organizations so AWS AI Services cannot use your content to improve the service, then confirm Q Developer users are on Pro rather than the free tier.
AWS (demo) · account 123456789012
In the AWS account
06-1709-14
management events onlyus-east-1
Identities
| Identity | Type | Events | Denied |
|---|---|---|---|
| i-0a1b2c3d | AssumedRole | 20 | 0 |
| contractor-ml | IAMUser | 15 | 0 |
Top actions
DetectPiiEntities20
AnalyzeDocument12
StartTranscriptionJob3
Resources
No resources of this kind in the regions checked.
Billing · AWS
What it costs
Last 30 days
$240
Previous 30
$181
Change
+33%
06-1609-13
123456789012 $146 · 123456789012 $93.99
Who
People
Identifiers come from device telemetry and proxy logs, so they may be account names rather than full directory entries.
| Person | Department | Source | Sign-ins · 30 d | Granted |
|---|---|---|---|---|
contractor-ml contractor-ml | n/a | AWS identity | 0 | No direct grant |
i-0a1b2c3d via AppServiceRole i-0a1b2c3d | n/a | AWS identity | 0 | No direct grant |
Why
Evidence
- cloudtrail_activity · Sep 13, 2026AWS (demo) (123456789012): AWS AI Services, 35 CloudTrail events by 2 identities, 3 write in 90 days across us-east-1
Detail
{ "services": [ "comprehend.amazonaws.com", "textract.amazonaws.com", "transcribe.amazonaws.com" ], "topActions": [ { "name": "DetectPiiEntities", "count": 20 }, { "name": "AnalyzeDocument", "count": 12 }, { "name": "StartTranscriptionJob", "count": 3 } ], "invocationLogging": null }