c1.3 Filter inputs and outputs with Amazon Bedrock Guardrails

What a guardrail gives you

Amazon Bedrock Guardrails is a policy layer you put in front of the model so safety and privacy rules live outside your prompt and outside your application code. One guardrail can be reused across models and applications, giving you a consistent, auditable safety baseline. It enforces several policy types together:

• Content filters — block Hate, Insults, Sexual, Violence, Misconduct, and Prompt Attack (prompt injection / jailbreak) categories, with an adjustable strength per category.
• Denied topics — natural-language topics your application must refuse (e.g. "investment advice").
• Word filters — exact-match words/phrases to block (profanity, competitor names).
• Sensitive information filters — detect PII and either block the request or redact it from the response.

Create a versioned guardrail

Define the policies once and create a guardrail. The content-filter block below turns on prompt-attack detection on inputs and harmful-content filtering on both sides:

aws bedrock create-guardrail \
  --name "prod-genai-guardrail" \
  --description "Baseline safety + PII controls for the app" \
  --blocked-input-messaging "Your request was blocked by our safety policy." \
  --blocked-outputs-messaging "The response was blocked by our safety policy." \
  --content-policy-config '{
    "filtersConfig": [
      { "type": "PROMPT_ATTACK", "inputStrength": "HIGH", "outputStrength": "NONE" },
      { "type": "HATE",          "inputStrength": "HIGH", "outputStrength": "HIGH" },
      { "type": "VIOLENCE",      "inputStrength": "HIGH", "outputStrength": "HIGH" }
    ]
  }' \
  --sensitive-information-policy-config '{
    "piiEntitiesConfig": [
      { "type": "EMAIL",              "action": "ANONYMIZE" },
      { "type": "CREDIT_DEBIT_CARD_NUMBER", "action": "BLOCK" }
    ]
  }'

Note: PROMPT_ATTACK only supports inputStrength (it is an input-side detection), so its outputStrength must be NONE.

Pin a version and apply it

create-guardrail returns a guardrailId. Publish an immutable version with create-guardrail-version, then reference guardrailIdentifier + guardrailVersion on every call — either as parameters to InvokeModel/Converse, or independently with the ApplyGuardrail API to screen text before you even invoke a model:

aws bedrock-runtime apply-guardrail \
  --guardrail-identifier "gr-0abc123456789def0" \
  --guardrail-version "1" \
  --source "INPUT" \
  --content '[{"text":{"text":"<user prompt to screen>"}}]'

Applying the guardrail before invocation lets you reject a bad prompt without paying for a model call.

Naming note: pin a specific guardrailVersion in production rather than the mutable DRAFT, so a policy change is a deliberate, reviewable deploy.