Author and Enforce Managed AIRS for AWS Policies in AIRS Profile

Table of Contents

Secure AI Traffic on Managed AIRS for AWS

Author and Enforce Managed AIRS for AWS Policies in AIRS Profile

Create folders, configure AI security policies, associate AIRS best-practice snippets, and assign AI security profiles to enforce protection on your Managed AIRS for AWS resources.

Where Can I Use This?	What Do I Need?
Managed AIRS for AWS	Access to Strata Cloud Manager (SCM)

You can use Strata Cloud Manager to globally apply AI security policy rules to the Managed AIRS for AWS resources comprising a folder

Create a folder for your Managed AIRS for AWS resource.
1. In Strata Cloud Manager, select Manage > Configuration > NGFW and Prisma Access.
2. Select Configuration Scope.
3. In the drop-down list, locate the folder containing the Cloud NGFW AWS resources:
4. In the Overview page, select Security Services:
5. In the Security Services drop-down list, select AI Security Policy:
  For more information about configuring Security policy using Strata Cloud Manager, see Manage Security Policy.
  You also an option to associate pre-defined AIRS-Best-Practice snippets (for pre-defined snippets) to the folder containing the Cloud NGFW AWS resources:
(Optional) Associate a pre-defined AIRS-Best-Practice snippet with the folder containing your Cloud NGFW AWS resources.
1. In Strata Cloud Manager, select ConfigurationNGFW and Prisma AccessOverview.
2. Click Snippet Management in the Configuration Scope panel.
3. From the Snippet Library tab, locate and opt in to the AIRS-Best-Practice snippet.
After opting in, associate the snippet with the appropriate scopes:
1. Select the AIRS-Best-Practice snippet.
2. In the Snippet Associations area, click the settings gear icon to display available scopes.
3. Choose the scopes — folders, deployments, or devices — that you want to associate with the snippet. For example, select folders such as Global, Prisma Access, or All Firewalls.
4. Push the configuration changes to your network.
Author an AI security profile for the security policy.
1. Create an AI security profile.
  Set up an AI security profile mapped to a model group targeting your preferred AI model environment (such as AWS Bedrock).
  Configure the profile to handle protections such as prompt injections, AI applications, and data leaks.
  Enable custom model support within the profile to forward traffic to the AI security cloud for inspection.
  
  For information about model groups, see Create Model Groups in Strata Cloud Manager.
2. Create model groups for customized protections and apply the configuration snippet and policy.
  Target Models — Associate the target large language model paths (such as AWS Cloud or specific model options).
  Action Policies — Map defensive parameters across AI Application Protection and AI Data Protection. Set specific prompt injection, data leak, or toxic content rules to either Alert or Block.
  Custom Model Support — Choose Enabled to force all matching traffic to the external AI security cloud for deep threat inspection instead of scanning only known static model endpoints.
3. Edit the target security policy and assign your profile group containing the AI rules to it.
  
  Once attached, verify under the policy details that the AI security profile is listed as active under that policy group.
4. Configure an outbound decryption policy.
  Create an outbound decryption rule targeted at outgoing traffic.
  Assign a proxy or decryption certificate to the rule. Without this decryption rule, the firewall cannot inspect the encrypted payload or read prompt strings.
5. Export the forward proxy CA certificate from Strata Cloud Manager and mount it into your application pods as a trusted root CA using a Kubernetes ConfigMap or Secret.