Bedrock has at least one guardrail configured in the audited region
bedrock_guardrails_configured
Amazon Bedrock guardrails provide reusable safety policies for filtering harmful or unwanted content in model inputs and outputs.
This evaluation checks whether at least one guardrail exists in each successfully scanned region. It does not verify that guardrails are attached to agents or passed on individual model invocation API calls.
Risk
Without any configured Bedrock guardrails in a region, teams lack a native reusable policy object for content filtering and safety controls. Applications may invoke models without standardized protections against harmful content, prompt injection, or sensitive-data exposure unless equivalent controls are enforced elsewhere.
prowler aws --checks bedrock_guardrails_configured
Recommendation
Create at least one Bedrock guardrail in each region where Bedrock is used, then separately ensure those guardrails are attached to relevant agents and invocation paths.
- Configure content filters for harmful categories (hate, violence, sexual, misconduct)
- Add sensitive information filters and denied topic policies
- Apply guardrails at the API call level using
guardrailIdentifierwhere supported
Remediation
aws bedrock create-guardrail --name example_resource --blocked-input-messaging 'Blocked' --blocked-outputs-messaging 'Blocked' --content-policy-config 'filtersConfig=[{type=HATE,inputStrength=HIGH,outputStrength=HIGH}]'
- Open the AWS Console and go to Amazon Bedrock
- Select Guardrails from the navigation pane
- Click Create guardrail
- Configure content filters for harmful categories
- Set input and output messaging for blocked content
- Click Create guardrail
Source Code
Resource Type
Other
References
Related To
- bedrock_guardrail_prompt_attack_filter_enabled
- bedrock_guardrail_sensitive_information_filter_enabled
- bedrock_agent_guardrail_enabled