RoleGPSPath to your AI role
Cloud, deployment & production

Secure keys, auth and data in AI apps

Secrets management, IAM least privilege, OAuth, tenant isolation, audit logs.

~8 focused hours·intermediate

Tools: IAM least privilege, secrets manager (Vault/AWS Secrets Manager), OAuth2/JWT, audit logging, OWASP Top 10

Market relevance — share of job ads asking for this
Prerequisite capability — not asked for directly, but needed for others.
What employers mean

You should be able to…

  1. Store API keys/DB credentials in a secrets manager, never in code or plaintext env files in git
  2. Set up least-privilege IAM roles so a service can only do what it needs to
  3. Add OAuth2/JWT auth to an API and validate tokens on every protected route
  4. Isolate tenant data in a multi-tenant system so one customer can't see another's data
  5. Log security-relevant events (auth failures, data access) for audit without logging secrets/PII
  6. Sanitize/validate user input to prevent injection attacks, including prompt injection in LLM inputs
  7. Rotate a leaked API key and confirm the old one is fully revoked

Needs first: Deploy an AI service to the cloud

Learn — free, link-checked

The few resources that matter

Read · beginner · 25 min · docs.aws.amazon.com

What is IAM?

Least-privilege IAM is the single most-tested security concept in Indian AI interviews; the canonical explanation of roles vs policies. — AWS
Read · intermediate · 25 min · docs.docker.com

Dockerfile best practices

Multi-stage builds, layer caching and running as non-root — the difference between a Dockerfile that works and one that's production- and security-ready. — Docker
Read · intermediate · 35 min · owasp.org

OWASP API Security Project

API-specific risks (broken object auth, excessive data exposure) that generic web security lists miss — directly relevant to LLM API wrappers. — OWASP
Read · intermediate · 40 min · owasp.org

OWASP Top 10

The industry-standard checklist of web app vulnerabilities (injection, broken auth, etc.) every AI backend must be reviewed against. — OWASP
Read · intermediate · 40 min · docs.aws.amazon.com

AWS Well-Architected — Security Pillar

A structured framework (identity, detection, data protection, incident response) for reasoning about security end to end, not just individual fixes. — AWS
Read · intermediate · 45 min · fastapi.tiangolo.com

FastAPI — Security (OAuth2, JWT)

Shows how to add real OAuth2/JWT auth to an API — the exact gap between a toy endpoint and one that's safe to ship. — FastAPI (tiangolo)
Practice

Multi-Tenant Security Hardening Pass

Take the FastAPI ticket/RAG API and add JWT-based auth with per-tenant scoping so every query is filtered by the authenticated tenant's ID, move all secrets to environment-injected config (never in git), add structured audit logging for auth failures and data access, and write a test that proves Tenant A cannot read Tenant B's data even with a crafted request.

Done when
  • Every data-access endpoint requires a valid JWT and filters results by the token's tenant ID
  • A test explicitly proves cross-tenant access is blocked (Tenant A's token can't read Tenant B's rows)
  • No secrets appear in the git history — verified with a secret-scanning tool run over the repo
  • Audit log records auth failures and data-access events with timestamp, tenant, and outcome, excluding secrets/PII
Prove it

Evidence a recruiter can check

  • Public GitHub repo with the auth/tenant-isolation code and the cross-tenant access test
  • Output of a secret-scanning tool (e.g. gitleaks/trufflehog) run over the repo showing zero findings
  • Sample audit log entries (redacted) demonstrating auth-failure and data-access logging
Interview

Questions you'll get asked

  1. How would you design tenant isolation so Customer A's data can never leak to Customer B?
  2. Where do you store a third-party API key, and what's wrong with putting it in a .env committed to git?
  3. How do you set up least-privilege IAM for a service that only reads from one S3 bucket?
  4. What's prompt injection, and how would you defend an LLM-backed app against it?
  5. How would you rotate a leaked API key in production with zero downtime?
  6. What would you log for a security audit without accidentally logging PII or secrets?
  7. Walk me through validating a JWT on an incoming request — what can go wrong if you skip a step?