AI Security Maturity Model·AWS v1.0.0

Drag to explore · pinch to zoom
Home / Matrix / Capability 5 / c5.6
Enhanced AI Application SecurityDefense-in-depth layer: AI Application Capability 5 · Generative AI agentsUse case: AI that acts 👤 CustomerAWS Shared Responsibility Model: who implements and operates this control. Customer = you own it; AWS = AWS operates it and you inherit it; Shared = both have obligations.

c5.6 Harden agent prompts and validate input with Guardrails

Protect the agent's reasoning from manipulation with guardrails, instruction hardening, and a pre-processing validation layer, so prompt attacks cannot redirect the agent.

Foundational
Enhanced
Advanced
Effort: Medium Impact: High GenAI scopesFrom the AWS Generative AI Security Scoping Matrix.: 3 · Pre-trained models; 4 · Fine-tuned models Agentic security dimensionsFrom the AWS Agentic AI Security Scoping Matrix.: Guardrails & monitoring

Implementation guidance

How to implement on AWS

Deploy a versioned Bedrock Guardrail invoked as part of the agent's response generation, with content filters, denied topics, and custom word filters. Harden agent instructions to resist manipulation, and add a pre-processing Lambda that sanitizes/validates input before it reaches the agent. Test regularly with adversarial techniques. Enforce guardrail use for direct Amazon Bedrock invocation with the bedrock:GuardrailIdentifier IAM condition key, so a model call without the approved guardrail is denied.

Acceptance criteria

A versioned guardrail runs in the agent's loop; instructions are hardened; a pre-processing validation layer exists; adversarial tests pass. A direct model invocation without the approved guardrail is denied.

Practical implementation

How this control is implemented in each reference architecture:

A versioned guardrail runs inside the agent's response loop in the Generative AI account, instructions are hardened, and a pre-processing Lambda validates input before it reaches the agent.

  1. Deploy a versioned Bedrock Guardrail invoked as part of the agent's response generation, with content filters, denied topics, and custom word filters.
    Generative AI account Amazon Bedrock
  2. Enforce guardrail use, not just configure it. Attach an IAM identity policy that denies bedrock:InvokeModel, bedrock:InvokeModelWithResponseStream, bedrock:Converse, and bedrock:ConverseStream unless the bedrock:GuardrailIdentifier condition key matches the approved guardrail and version. To apply a guardrail across OUs or accounts, use an Amazon Bedrock policy in AWS Organizations that points to a versioned guardrail. This applies to direct Amazon Bedrock invocation; keep content guarding comprehensive so callers cannot skip evaluation with guard content tags.
    Generative AI OU Amazon Bedrock IAM AWS Organizations
  3. Harden agent instructions to resist manipulation, and add a pre-processing Lambda that sanitizes/validates input before it reaches the agent.
    Generative AI account AWS Lambda
  4. Run adversarial test techniques regularly against the agent loop.
    Generative AI account Bedrock AgentCore

How to validate: A versioned guardrail runs in the agent's loop; instructions are hardened; a pre-processing validation layer exists; adversarial tests pass. A direct model invocation without the approved guardrail is denied.

Avoid: Relying on the system prompt alone to resist injection. Add a guardrail in the loop and a validation layer; prompts are not a security boundary.

Generative AI OU (multi-account) →

A versioned guardrail in the agent loop, hardened instructions, and a pre-processing validation Lambda protect the agent's reasoning within the account.

  1. Run a versioned Bedrock Guardrail in the agent's response generation with content, denied-topic, and custom-word filters.
    Generative AI tier (IAM role) Amazon Bedrock
  2. Enforce guardrail use, not just configure it. Attach an IAM identity policy that denies bedrock:InvokeModel, bedrock:InvokeModelWithResponseStream, bedrock:Converse, and bedrock:ConverseStream unless the bedrock:GuardrailIdentifier condition key matches the approved guardrail and version. As an alternative or addition, set account-level guardrail enforcement in each Region you use. This applies to direct Amazon Bedrock invocation. The IAM condition key alone does not stop a caller from skipping prompt evaluation with guard content tags, so set content guarding to comprehensive in the account-level enforcement configuration. Do not use a role with this condition for APIs that call models on your behalf, such as RetrieveAndGenerate, InvokeAgent or InvokeInlineAgent, because some of those internal calls carry no guardrail and are denied.
    Generative AI tier (IAM role) Amazon Bedrock IAM
  3. Harden instructions and add a pre-processing Lambda that validates input before the agent.
    Generative AI tier (IAM role) AWS Lambda
  4. Test regularly with adversarial techniques.
    Generative AI tier (IAM role) Amazon Bedrock

How to validate: A versioned guardrail runs in the loop; instructions are hardened; a validation layer exists; adversarial tests pass. A direct model invocation without the approved guardrail is denied.

Avoid: No guardrail inside the agent loop. Injection can redirect the agent; filter and validate at every turn.

Single account (entry point) →

Threats addressed

  • Prompt injection manipulating the agent's reasoning into unintended actions.
  • Hallucinated or unwanted behavior from an unguarded agent.

AWS services

Amazon Bedrock Guardrails AWS Lambda

Framework mappings

OWASP GenAI/LLM Top 10 (2026)

  • LLM01 Prompt Injection
  • LLM07 Misinformation

NIST AI Risk Management Framework (AI 100-1)

  • MEASURE.2 AI systems are evaluated for trustworthy characteristics
  • MANAGE.1 AI risks are prioritized, responded to and managed

AWS Well-Architected Generative AI Lens (Security)

  • GENSEC04-BP01 Implement a secure prompt catalog
  • GENSEC04-BP02 Sanitize and validate user inputs to foundation models

OWASP GenAI Top 10 for Agentic Applications (2025)

  • ASI01 Agent Goal Hijack

Learning resources

References

  • AWS SRA for AI — Capability 5, Application security