GenAI Developer
Amazon Bedrock Guardrails Explained: Content Filters, PII Masking and Grounding Checks
Amazon Bedrock Guardrails let you add content filters, denied topics, word filters, sensitive information (PII) filters, contextual grounding checks and Automated Reasoning checks to model inputs and outputs. PII can be blocked or masked, grounding thresholds go from 0 to 0.99, and the bedrock:GuardrailIdentifier IAM condition key can force every inference call to use an approved guardrail.
The guardrail policy types
| Policy | What it does |
|---|---|
| Content filters | Detect harmful text or image content in the categories Hate, Insults, Sexual, Violence, Misconduct and Prompt Attack, each with its own strength. |
| Prompt attacks | A content filter category that detects jailbreaks and prompt injections; prompt leakage detection needs the Standard tier. |
| Denied topics | Topics the application must avoid, such as illegal investment advice. |
| Word filters | Exact-match words or phrases, such as profanity or competitor names. |
| Sensitive information filters | Detect PII or custom regex entities and block or mask them. |
| Contextual grounding checks | Flag responses that are not grounded in the source or not relevant to the query. |
| Automated Reasoning checks | Validate that responses follow logical rules and policies you define. |
Source: docs.aws.amazon.com/bedrock/latest/userguide/guardrails-components.html
A guardrail must contain at least one filter and the messaging to show when a prompt or response is blocked.
PII: block or mask
The sensitive information filter is a probabilistic, context-dependent ML filter. Block rejects the whole request or response; mask replaces the value with its type, for example `{NAME}` or `{EMAIL}`. You can also define custom regex entities (lookaround is not supported).
Contextual grounding: catching hallucinations
A grounding check scores two things: grounding (is the answer supported by the source?) and relevance (does it answer the question?). It needs the grounding source, the query and the content to guard, and it only runs on the model output.
- Thresholds go from 0 to 0.99; a response below the threshold is blocked. A higher threshold blocks more and lets fewer hallucinations through. A threshold of 1 is invalid.
- Limits: 100,000 characters of source, 1,000 of query and 5,000 of response.
- With a streaming API, an irrelevant response can reach the user before it is flagged, because the whole response must be streamed first.
Detect mode: test before you block
Each filter can use the action NONE, which takes no action but returns detection information. That lets you measure how a guardrail behaves on real traffic before switching it to block or mask.
Make guardrails mandatory with IAM
Add the `bedrock:GuardrailIdentifier` condition key to an IAM policy with an explicit Deny, so any `InvokeModel`, `InvokeModelWithResponseStream`, `Converse` or `ConverseStream` call without the approved guardrail is rejected.
- Do not use the same restricted role for `RetrieveAndGenerate`, `InvokeAgent` or `InvokeInlineAgent`: they make several model calls and some do not carry the guardrail, which causes access denied errors.
- Guardrail input tags can skip evaluation of parts of the prompt, but the response is always evaluated.
- Guardrails can be shared across accounts only inside the same AWS organization.
Why it matters for AIP-C01
Domain 3 (AI Safety, Security, and Governance) is 20% of the exam, and its first task is input and output safety controls. See Domain 3 and the study topic Bedrock Guardrails: filters, PII and grounding.
Frequently asked questions
What is the difference between block and mask in Bedrock Guardrails?
Block rejects the whole request or response when PII is found; mask replaces each PII value with its type, such as {NAME}.
What threshold should a contextual grounding check use?
Any value from 0 to 0.99. Higher thresholds block more ungrounded or irrelevant responses. A value of 1 is invalid.
Do Bedrock Guardrails mask PII in invocation logs?
No. Masking applies to model inputs and outputs; the invocation log keeps the original input. Use CloudWatch Logs data protection for logs.
How do I force every Bedrock call to use a guardrail?
Use the bedrock:GuardrailIdentifier IAM condition key with an explicit Deny for requests that do not specify the approved guardrail.
Sources
- Create your guardrail (AWS)
- Sensitive information filters (AWS)
- Contextual grounding check (AWS)
- Enforce guardrails with IAM (AWS)
AWS updates its programs and documentation. Check the linked official pages for the latest details before you decide or pay.
Practice for AIP-C01
Free AWS Generative AI Developer – Professional practice questions with an explanation for every option. No sign-up.
Keep reading
- GenAI Developer
AIP-C01 Study Plan: Pass AWS GenAI Developer Pro
A 4-week AIP-C01 study plan built on the official exam guide: domain weights, what is out of scope, the format and how to practice for each domain.
3 min read - GenAI Developer
Bedrock Knowledge Base Chunking Strategies Compared
Compare chunking in Amazon Bedrock Knowledge Bases: default, fixed-size, hierarchical, semantic and no chunking, plus hybrid search, reranking and filters.
2 min read - GenAI Developer
Bedrock Provisioned Throughput vs Cross-Region Inference
When to use Bedrock Provisioned Throughput, cross-Region inference, batch inference, prompt caching or intelligent prompt routing, with official AWS facts.
2 min read