Check provider logo

Amazon Bedrock guardrail blocks or masks sensitive information

bedrock_guardrail_sensitive_information_filter_enabled

Severityhigh
Servicebedrock
by Prowler
gen-ai

Bedrock guardrails use sensitive information filters to block or mask detected PII and custom pattern matches in prompts and responses.

The evaluation looks for guardrails with this filtering configured.

Risk

Absent filtering, prompts or outputs can reveal PII, credentials, or financial records, compromising confidentiality.

  • Exposed tokens enable unauthorized access and data tampering (integrity)
  • Disclosed customer details facilitate fraud and identity theft, with potential lateral movement
Run this check with Prowler CLI

prowler aws --checks bedrock_guardrail_sensitive_information_filter_enabled

Run in Prowler Cloud

Recommendation

Enable and tune sensitive information filters for inputs and outputs.

  • Use BLOCK for high-risk disclosures; ANONYMIZE when context is needed
  • Add custom regex for org-specific IDs
  • Apply least privilege and data minimization
  • Test regularly and monitor outcomes as part of defense-in-depth

Remediation

CLI

aws bedrock update-guardrail --guardrail-identifier <example_resource_id> --sensitive-information-policy-config '{"piiEntitiesConfig":[{"type":"EMAIL","action":"ANONYMIZE"}]}'

Other
  1. Sign in to the AWS Console and open Amazon Bedrock
  2. Go to Guardrails and select <example_resource_name>
  3. Click Edit (or Open draft) and open Sensitive information filters
  4. Add PII type EMAIL and set action to Mask (or Block)
  5. Click Save

Source Code

Resource Type

Other

References