Bedrock Guardrails Should Use Customer Managed Keys For Encryption

Using Console

To use a customer managed KMS key (CMK) for AWS Bedrock Guardrails via the AWS console, you generally need to:

Create (or verify) a suitable KMS key
Configure its key policy so Bedrock can use it
Create a new Guardrail that uses that CMK (you cannot switch an existing Guardrail from AWS-owned to CMK; you must recreate it)

1. Create a customer managed KMS key

Sign in to the AWS Management Console in the same region where your Guardrails are or will be.
Go to Key Management Service (KMS):
Services → Key Management Service.
In the left pane, choose Customer managed keys → Create key.
Key type: choose Symmetric.
Key usage: Encrypt and decrypt.
Click Next.
Alias: give it a meaningful name, e.g. alias/bedrock-guardrails-cmk.
Optionally add description and tags. Click Next.
Key administrators: select IAM users/roles who can manage the key (e.g., a security admin role). Click Next.
Key users: add the IAM roles/users that will use Bedrock and need to encrypt/decrypt data with this key (e.g. your Bedrock service role or application roles).
Click Next, then Finish to create the key.

2. Ensure KMS key policy allows Bedrock to use the key

You must allow the Bedrock service to use this key. In console terms:

In KMS, select your new key (by alias).
Go to the Key policy tab.
If using the default policy model (recommended), use Switch to policy view.

You need a statement that allows bedrock.amazonaws.com to use the key, scoped to your account and region. If the console doesn’t provide a wizard entry for Bedrock yet, you can add something equivalent to this (adjust region and account):

{
  "Sid": "AllowBedrockUseOfKey",
  "Effect": "Allow",
  "Principal": {
    "Service": "bedrock.amazonaws.com"
  },
  "Action": [
    "kms:Encrypt",
    "kms:Decrypt",
    "kms:GenerateDataKey*",
    "kms:DescribeKey"
  ],
  "Resource": "*",
  "Condition": {
    "StringEquals": {
      "aws:SourceAccount": "YOUR_AWS_ACCOUNT_ID"
    },
    "ArnLike": {
      "aws:SourceArn": "arn:aws:bedrock:REGION:YOUR_AWS_ACCOUNT_ID:*"
    }
  }
}

Save the key policy.

(If your organization manages KMS policies centrally or restricts inline editing, coordinate with your security/KMS team to add this.)

3. Create a Guardrail using the CMK

Existing Bedrock Guardrails that were created with AWS-owned keys generally cannot be switched to CMK in-place; create a new Guardrail and point your applications to it.

Go to Amazon Bedrock in the console.
In the left navigation, choose Guardrails.
Click Create guardrail.
Configure:
- Name, Description
- Your content filters, policies, and other settings as needed.
Look for Encryption or Encryption key (sometimes under Advanced settings or similar, depending on UI version).
Select Use a customer managed key (or equivalent wording).
From the dropdown, choose the alias of the CMK you created (e.g. alias/bedrock-guardrails-cmk).
Complete the remaining configuration and click Create.

4. Migrate usage to the new Guardrail

Update any applications, agents, or workflows that reference the old Guardrail ID to use the new Guardrail ID.
Test to confirm Bedrock operations using the Guardrail succeed and there are no KMS access errors (if you see AccessDeniedException from KMS, revisit the key policy and IAM roles).

Once you have fully transitioned, you can optionally delete or disable the old Guardrail that used AWS-owned keys.

Using CLI

Below are concise, AWS‑CLI–only steps to move an existing Bedrock Guardrail to use a customer‑managed KMS key (CMK) instead of the AWS‑managed key.

1. Create a Customer-Managed KMS Key

aws kms create-key \
  --description "CMK for Bedrock Guardrails encryption" \
  --key-usage ENCRYPT_DECRYPT \
  --origin AWS_KMS \
  --output json

Note the "KeyId" or "Arn" from the output (call it KMS_KEY_ID).(Optional) Create an alias:

aws kms create-alias \
  --alias-name alias/bedrock-guardrails-cmk \
  --target-key-id "$KMS_KEY_ID"

You can then use the alias ARN: arn:aws:kms:<region>:<account-id>:alias/bedrock-guardrails-cmk

2. Ensure the KMS Key Policy Allows Bedrock to Use It

Get the existing key policy:

aws kms get-key-policy \
  --key-id "$KMS_KEY_ID" \
  --policy-name default \
  --output text > key-policy.json

Edit key-policy.json and add a statement like (merge with existing policy):

{
  "Sid": "AllowBedrockGuardrailsUseOfKey",
  "Effect": "Allow",
  "Principal": {
    "Service": "bedrock.amazonaws.com"
  },
  "Action": [
    "kms:Encrypt",
    "kms:Decrypt",
    "kms:GenerateDataKey*",
    "kms:DescribeKey"
  ],
  "Resource": "*",
  "Condition": {
    "StringEquals": {
      "aws:SourceAccount": "<YOUR_ACCOUNT_ID>"
    },
    "ArnLike": {
      "aws:SourceArn": "arn:aws:bedrock:*:<YOUR_ACCOUNT_ID>:guardrail/*"
    }
  }
}

Then apply the updated policy:

aws kms put-key-policy \
  --key-id "$KMS_KEY_ID" \
  --policy-name default \
  --policy file://key-policy.json

3. Get the Existing Guardrail Configuration

aws bedrock get-guardrail \
  --guardrail-identifier "<GUARDRAIL_ID_OR_ARN>" \
  --guardrail-version "<VERSION_NUMBER>" \
  --output json > guardrail.json

You need the latest version number and current config to reuse fields.

4. Update the Guardrail to Use the CMK

Edit guardrail.json:

Remove read-only fields such as status, createdAt, updatedAt, arn, etc.
Keep/adjust only the editable configuration (e.g., name, description, topicPolicyConfig, contentPolicyConfig, etc.).
Add or update the encryption configuration to include your KMS key ARN:

"encryptionConfiguration": {
  "kmsKeyId": "arn:aws:kms:<region>:<account-id>:alias/bedrock-guardrails-cmk"
}

Then run:

aws bedrock update-guardrail \
  --guardrail-identifier "<GUARDRAIL_ID_OR_ARN>" \
  --cli-input-json file://guardrail.json

5. Verify the Guardrail Now Uses the CMK

aws bedrock get-guardrail \
  --guardrail-identifier "<GUARDRAIL_ID_OR_ARN>" \
  --guardrail-version "DRAFT" \
  --output json | jq '.encryptionConfiguration'

You should see your CMK ARN under kmsKeyId.

Using Python

To use a customer-managed KMS key (CMK) for Amazon Bedrock Guardrails with Python, you need to:

Create or choose a KMS CMK
Add the right key policy / IAM permissions
Create or update the guardrail with the CMK

Below is a concise, end‑to‑end walkthrough with boto3.

1. Create a KMS CMK (if you don’t have one)

import boto3

region = "us-east-1"  # change as needed
kms = boto3.client("kms", region_name=region)

response = kms.create_key(
    Description="CMK for Bedrock Guardrails encryption",
    KeyUsage="ENCRYPT_DECRYPT",
    Origin="AWS_KMS",
    KeySpec="SYMMETRIC_DEFAULT",
)
kms_key_id = response["KeyMetadata"]["KeyId"]
print("KMS KeyId:", kms_key_id)

Optionally, create an alias:

kms.create_alias(
    AliasName="alias/bedrock-guardrails-cmk",
    TargetKeyId=kms_key_id
)

2. Ensure KMS key policy / IAM permissions

At minimum, allow the IAM role/user that calls Bedrock APIs to use the key for Encrypt, Decrypt, etc.Example KMS key policy statement to add (using the principal that runs your Python code, e.g. an IAM role ARN):

{
  "Sid": "AllowBedrockCallerUseOfKey",
  "Effect": "Allow",
  "Principal": {
    "AWS": "arn:aws:iam::123456789012:role/YourBedrockAppRole"
  },
  "Action": [
    "kms:Encrypt",
    "kms:Decrypt",
    "kms:GenerateDataKey",
    "kms:DescribeKey"
  ],
  "Resource": "*"
}

You can fetch and update the key policy via boto3, or edit it in the console.Also ensure the principal’s IAM policy allows calling those kms:* actions on this CMK.

3. Create a new guardrail using the CMK

Use the Bedrock control-plane client (bedrock or bedrock-control-plane, depending on your SDK version). Example with boto3:

import boto3

region = "us-east-1"
bedrock = boto3.client("bedrock", region_name=region)

kms_key_arn = f"arn:aws:kms:{region}:123456789012:key/{kms_key_id}"
# or: "arn:aws:kms:region:account-id:alias/bedrock-guardrails-cmk"

response = bedrock.create_guardrail(
    name="my-guardrail",
    description="Guardrail with CMK encryption",
    kmsKeyId=kms_key_arn,  # <-- use CMK here
    blockedInputMessaging="Blocked by guardrail.",
    blockedOutputsMessaging="Blocked by guardrail.",
    contentPolicyConfig={
        "filtersConfig": [
            {
                "type": "HATE",
                "inputStrength": "HIGH",
                "outputStrength": "HIGH"
            }
        ]
    }
    # add other config sections as required (e.g. sensitiveInformationPolicyConfig, etc.)
)

guardrail_arn = response["guardrailArn"]
print("Created guardrail:", guardrail_arn)

kmsKeyId can be a key ID, key ARN, alias name, or alias ARN; using the ARN is safest.

4. Update an existing guardrail to use the CMK

If you have an existing guardrail using an AWS-managed key, update it with update_guardrail:

existing_guardrail_id = "grd-xxxxxxxxxxxxxxxx"  # or ARN
existing_guardrail_version = "DRAFT"            # or specific version, often "DRAFT"

response = bedrock.update_guardrail(
    guardrailIdentifier=existing_guardrail_id,
    guardrailVersion=existing_guardrail_version,
    kmsKeyId=kms_key_arn,  # <-- switch to CMK
    # You must supply other existing settings as well:
    name="my-guardrail",
    description="Updated guardrail using CMK",
    blockedInputMessaging="Blocked by guardrail.",
    blockedOutputsMessaging="Blocked by guardrail.",
    contentPolicyConfig={
        "filtersConfig": [
            {
                "type": "HATE",
                "inputStrength": "HIGH",
                "outputStrength": "HIGH"
            }
        ]
    }
    # and any other configs originally present
)

print("Updated guardrail to CMK.")

Note: update_guardrail generally requires you to provide all required configuration fields, not just kmsKeyId, so you may want to first get_guardrail and reuse its config.

5. Verify encryption setting

Use get_guardrail and confirm kmsKeyId is set:

resp = bedrock.get_guardrail(
    guardrailIdentifier=guardrail_arn,
    guardrailVersion="DRAFT"
)

print("kmsKeyId:", resp.get("kmsKeyId"))

If this value is your CMK ARN/alias, the guardrail is now using customer-managed keys for encryption.

AWS Introduction

AWS Pricing

AWS Threats

AWS Misconfigurations

Bedrock Guardrails Should Use Customer Managed Keys For Encryption

More Info:

Risk Level

Address

Compliance Standards

Triage and Remediation

Remediation

1. Create a customer managed KMS key

2. Ensure KMS key policy allows Bedrock to use the key

3. Create a Guardrail using the CMK

4. Migrate usage to the new Guardrail

1. Create a Customer-Managed KMS Key

2. Ensure the KMS Key Policy Allows Bedrock to Use It

3. Get the Existing Guardrail Configuration

4. Update the Guardrail to Use the CMK

5. Verify the Guardrail Now Uses the CMK

1. Create a KMS CMK (if you don’t have one)

2. Ensure KMS key policy / IAM permissions

3. Create a new guardrail using the CMK

4. Update an existing guardrail to use the CMK

5. Verify encryption setting

​More Info:

​Risk Level

​Address

​Compliance Standards

​Triage and Remediation

​Remediation

​1. Create a customer managed KMS key

​2. Ensure KMS key policy allows Bedrock to use the key

​3. Create a Guardrail using the CMK

​4. Migrate usage to the new Guardrail

​1. Create a Customer-Managed KMS Key

​2. Ensure the KMS Key Policy Allows Bedrock to Use It

​3. Get the Existing Guardrail Configuration

​4. Update the Guardrail to Use the CMK

​5. Verify the Guardrail Now Uses the CMK

​1. Create a KMS CMK (if you don’t have one)

​2. Ensure KMS key policy / IAM permissions

​3. Create a new guardrail using the CMK

​4. Update an existing guardrail to use the CMK

​5. Verify encryption setting

More Info:

Risk Level

Address

Compliance Standards

Triage and Remediation

Remediation

1. Create a customer managed KMS key

2. Ensure KMS key policy allows Bedrock to use the key

3. Create a Guardrail using the CMK

4. Migrate usage to the new Guardrail

1. Create a Customer-Managed KMS Key

2. Ensure the KMS Key Policy Allows Bedrock to Use It

3. Get the Existing Guardrail Configuration

4. Update the Guardrail to Use the CMK

5. Verify the Guardrail Now Uses the CMK

1. Create a KMS CMK (if you don’t have one)

2. Ensure KMS key policy / IAM permissions

3. Create a new guardrail using the CMK

4. Update an existing guardrail to use the CMK

5. Verify encryption setting