> ## Documentation Index
> Fetch the complete documentation index at: https://cloudanix.com/docs/llms.txt
> Use this file to discover all available pages before exploring further.

# Bedrock Guardrails Should Use Customer Managed Keys For Encryption

### More Info:

Bedrock Guardrails should use Customer Managed Keys for Encryption

### Risk Level

High

### Address

Security

### Compliance Standards

* APRA CPS 234 (Australia)
* BSI C5 (Germany)
* Brazil LGPD
* CCPA / CPRA (California)
* CIS Critical Security Controls v8
* CMMC 2.0
* CSA Cloud Controls Matrix v4
* DPDPA
* Digital Operational Resilience Act (EU)
* ISO/IEC 27018
* ISO/IEC 27701
* MAS Technology Risk Management (Singapore)
* MITRE ATT\&CK (Cloud)
* NIST SP 800-171
* NYDFS 23 NYCRR 500
* SOC2
* SWIFT Customer Security Controls Framework
* Sarbanes-Oxley IT General Controls
* StateRAMP
* UK NCSC Cyber Assessment Framework

### Triage and Remediation

<Tabs>
  <Tab title="Remediation">
    ### Remediation

    <AccordionGroup>
      <Accordion title="Using Console" defaultOpen="true">
        To use a customer managed KMS key (CMK) for AWS Bedrock Guardrails via the AWS console, you generally need to:

        1. Create (or verify) a suitable KMS key
        2. Configure its key policy so Bedrock can use it
        3. Create a new Guardrail that uses that CMK (you cannot switch an existing Guardrail from AWS-owned to CMK; you must recreate it)

        ***

        ## 1. Create a customer managed KMS key

        1. Sign in to the AWS Management Console in the **same region** where your Guardrails are or will be.
        2. Go to **Key Management Service (KMS)**:\
           Services → **Key Management Service**.
        3. In the left pane, choose **Customer managed keys** → **Create key**.
        4. **Key type**: choose **Symmetric**.\
           **Key usage**: **Encrypt and decrypt**.\
           Click **Next**.
        5. **Alias**: give it a meaningful name, e.g. `alias/bedrock-guardrails-cmk`.\
           Optionally add description and tags. Click **Next**.
        6. **Key administrators**: select IAM users/roles who can manage the key (e.g., a security admin role). Click **Next**.
        7. **Key users**: add the IAM roles/users that will use Bedrock and need to encrypt/decrypt data with this key (e.g. your Bedrock service role or application roles).\
           Click **Next**, then **Finish** to create the key.

        ***

        ## 2. Ensure KMS key policy allows Bedrock to use the key

        You must allow the Bedrock service to use this key. In console terms:

        1. In KMS, select your new key (by alias).

        2. Go to the **Key policy** tab.

        3. If using the default policy model (recommended), use **Switch to policy view**.

        4. You need a statement that allows `bedrock.amazonaws.com` to use the key, scoped to your account and region. If the console doesn’t provide a wizard entry for Bedrock yet, you can add something equivalent to this (adjust region and account):

           ```json theme={null}
           {
             "Sid": "AllowBedrockUseOfKey",
             "Effect": "Allow",
             "Principal": {
               "Service": "bedrock.amazonaws.com"
             },
             "Action": [
               "kms:Encrypt",
               "kms:Decrypt",
               "kms:GenerateDataKey*",
               "kms:DescribeKey"
             ],
             "Resource": "*",
             "Condition": {
               "StringEquals": {
                 "aws:SourceAccount": "YOUR_AWS_ACCOUNT_ID"
               },
               "ArnLike": {
                 "aws:SourceArn": "arn:aws:bedrock:REGION:YOUR_AWS_ACCOUNT_ID:*"
               }
             }
           }
           ```

        5. Save the key policy.

        (If your organization manages KMS policies centrally or restricts inline editing, coordinate with your security/KMS team to add this.)

        ***

        ## 3. Create a Guardrail using the CMK

        Existing Bedrock Guardrails that were created with AWS-owned keys generally cannot be switched to CMK in-place; create a new Guardrail and point your applications to it.

        1. Go to **Amazon Bedrock** in the console.
        2. In the left navigation, choose **Guardrails**.
        3. Click **Create guardrail**.
        4. Configure:
           * **Name**, **Description**
           * Your content filters, policies, and other settings as needed.
        5. Look for **Encryption** or **Encryption key** (sometimes under **Advanced settings** or similar, depending on UI version).
        6. Select **Use a customer managed key** (or equivalent wording).
        7. From the dropdown, choose the alias of the CMK you created (e.g. `alias/bedrock-guardrails-cmk`).
        8. Complete the remaining configuration and click **Create**.

        ***

        ## 4. Migrate usage to the new Guardrail

        1. Update any applications, agents, or workflows that reference the old Guardrail ID to use the **new Guardrail ID**.
        2. Test to confirm Bedrock operations using the Guardrail succeed and there are no KMS access errors (if you see `AccessDeniedException` from KMS, revisit the key policy and IAM roles).

        Once you have fully transitioned, you can optionally delete or disable the old Guardrail that used AWS-owned keys.
      </Accordion>

      <Accordion title="Using CLI">
        Below are concise, AWS‑CLI–only steps to move an existing Bedrock Guardrail to use a customer‑managed KMS key (CMK) instead of the AWS‑managed key.

        ***

        ### 1. Create a Customer-Managed KMS Key

        ```bash theme={null}
        aws kms create-key \
          --description "CMK for Bedrock Guardrails encryption" \
          --key-usage ENCRYPT_DECRYPT \
          --origin AWS_KMS \
          --output json
        ```

        Note the `"KeyId"` or `"Arn"` from the output (call it `KMS_KEY_ID`).

        (Optional) Create an alias:

        ```bash theme={null}
        aws kms create-alias \
          --alias-name alias/bedrock-guardrails-cmk \
          --target-key-id "$KMS_KEY_ID"
        ```

        You can then use the alias ARN:
        `arn:aws:kms:<region>:<account-id>:alias/bedrock-guardrails-cmk`

        ***

        ### 2. Ensure the KMS Key Policy Allows Bedrock to Use It

        Get the existing key policy:

        ```bash theme={null}
        aws kms get-key-policy \
          --key-id "$KMS_KEY_ID" \
          --policy-name default \
          --output text > key-policy.json
        ```

        Edit `key-policy.json` and add a statement like (merge with existing policy):

        ```json theme={null}
        {
          "Sid": "AllowBedrockGuardrailsUseOfKey",
          "Effect": "Allow",
          "Principal": {
            "Service": "bedrock.amazonaws.com"
          },
          "Action": [
            "kms:Encrypt",
            "kms:Decrypt",
            "kms:GenerateDataKey*",
            "kms:DescribeKey"
          ],
          "Resource": "*",
          "Condition": {
            "StringEquals": {
              "aws:SourceAccount": "<YOUR_ACCOUNT_ID>"
            },
            "ArnLike": {
              "aws:SourceArn": "arn:aws:bedrock:*:<YOUR_ACCOUNT_ID>:guardrail/*"
            }
          }
        }
        ```

        Then apply the updated policy:

        ```bash theme={null}
        aws kms put-key-policy \
          --key-id "$KMS_KEY_ID" \
          --policy-name default \
          --policy file://key-policy.json
        ```

        ***

        ### 3. Get the Existing Guardrail Configuration

        ```bash theme={null}
        aws bedrock get-guardrail \
          --guardrail-identifier "<GUARDRAIL_ID_OR_ARN>" \
          --guardrail-version "<VERSION_NUMBER>" \
          --output json > guardrail.json
        ```

        You need the latest version number and current config to reuse fields.

        ***

        ### 4. Update the Guardrail to Use the CMK

        Edit `guardrail.json`:

        * Remove read-only fields such as `status`, `createdAt`, `updatedAt`, `arn`, etc.
        * Keep/adjust only the editable configuration (e.g., `name`, `description`, `topicPolicyConfig`, `contentPolicyConfig`, etc.).
        * Add or update the encryption configuration to include your KMS key ARN:

        ```json theme={null}
        "encryptionConfiguration": {
          "kmsKeyId": "arn:aws:kms:<region>:<account-id>:alias/bedrock-guardrails-cmk"
        }
        ```

        Then run:

        ```bash theme={null}
        aws bedrock update-guardrail \
          --guardrail-identifier "<GUARDRAIL_ID_OR_ARN>" \
          --cli-input-json file://guardrail.json
        ```

        ***

        ### 5. Verify the Guardrail Now Uses the CMK

        ```bash theme={null}
        aws bedrock get-guardrail \
          --guardrail-identifier "<GUARDRAIL_ID_OR_ARN>" \
          --guardrail-version "DRAFT" \
          --output json | jq '.encryptionConfiguration'
        ```

        You should see your CMK ARN under `kmsKeyId`.
      </Accordion>

      <Accordion title="Using Python">
        To use a customer-managed KMS key (CMK) for Amazon Bedrock Guardrails with Python, you need to:

        1. **Create or choose a KMS CMK**
        2. **Add the right key policy / IAM permissions**
        3. **Create or update the guardrail with the CMK**

        Below is a concise, end‑to‑end walkthrough with `boto3`.

        ***

        ## 1. Create a KMS CMK (if you don’t have one)

        ```python theme={null}
        import boto3

        region = "us-east-1"  # change as needed
        kms = boto3.client("kms", region_name=region)

        response = kms.create_key(
            Description="CMK for Bedrock Guardrails encryption",
            KeyUsage="ENCRYPT_DECRYPT",
            Origin="AWS_KMS",
            KeySpec="SYMMETRIC_DEFAULT",
        )
        kms_key_id = response["KeyMetadata"]["KeyId"]
        print("KMS KeyId:", kms_key_id)
        ```

        Optionally, create an alias:

        ```python theme={null}
        kms.create_alias(
            AliasName="alias/bedrock-guardrails-cmk",
            TargetKeyId=kms_key_id
        )
        ```

        ***

        ## 2. Ensure KMS key policy / IAM permissions

        At minimum, allow the IAM role/user that calls Bedrock APIs to use the key for `Encrypt`, `Decrypt`, etc.

        Example KMS key policy statement to add (using the principal that runs your Python code, e.g. an IAM role ARN):

        ```json theme={null}
        {
          "Sid": "AllowBedrockCallerUseOfKey",
          "Effect": "Allow",
          "Principal": {
            "AWS": "arn:aws:iam::123456789012:role/YourBedrockAppRole"
          },
          "Action": [
            "kms:Encrypt",
            "kms:Decrypt",
            "kms:GenerateDataKey",
            "kms:DescribeKey"
          ],
          "Resource": "*"
        }
        ```

        You can fetch and update the key policy via `boto3`, or edit it in the console.

        Also ensure the principal’s IAM policy allows calling those `kms:*` actions on this CMK.

        ***

        ## 3. Create a new guardrail using the CMK

        Use the Bedrock control-plane client (`bedrock` or `bedrock-control-plane`, depending on your SDK version). Example with `boto3`:

        ```python theme={null}
        import boto3

        region = "us-east-1"
        bedrock = boto3.client("bedrock", region_name=region)

        kms_key_arn = f"arn:aws:kms:{region}:123456789012:key/{kms_key_id}"
        # or: "arn:aws:kms:region:account-id:alias/bedrock-guardrails-cmk"

        response = bedrock.create_guardrail(
            name="my-guardrail",
            description="Guardrail with CMK encryption",
            kmsKeyId=kms_key_arn,  # <-- use CMK here
            blockedInputMessaging="Blocked by guardrail.",
            blockedOutputsMessaging="Blocked by guardrail.",
            contentPolicyConfig={
                "filtersConfig": [
                    {
                        "type": "HATE",
                        "inputStrength": "HIGH",
                        "outputStrength": "HIGH"
                    }
                ]
            }
            # add other config sections as required (e.g. sensitiveInformationPolicyConfig, etc.)
        )

        guardrail_arn = response["guardrailArn"]
        print("Created guardrail:", guardrail_arn)
        ```

        `kmsKeyId` can be a key ID, key ARN, alias name, or alias ARN; using the ARN is safest.

        ***

        ## 4. Update an existing guardrail to use the CMK

        If you have an existing guardrail using an AWS-managed key, update it with `update_guardrail`:

        ```python theme={null}
        existing_guardrail_id = "grd-xxxxxxxxxxxxxxxx"  # or ARN
        existing_guardrail_version = "DRAFT"            # or specific version, often "DRAFT"

        response = bedrock.update_guardrail(
            guardrailIdentifier=existing_guardrail_id,
            guardrailVersion=existing_guardrail_version,
            kmsKeyId=kms_key_arn,  # <-- switch to CMK
            # You must supply other existing settings as well:
            name="my-guardrail",
            description="Updated guardrail using CMK",
            blockedInputMessaging="Blocked by guardrail.",
            blockedOutputsMessaging="Blocked by guardrail.",
            contentPolicyConfig={
                "filtersConfig": [
                    {
                        "type": "HATE",
                        "inputStrength": "HIGH",
                        "outputStrength": "HIGH"
                    }
                ]
            }
            # and any other configs originally present
        )

        print("Updated guardrail to CMK.")
        ```

        Note: `update_guardrail` generally requires you to provide all required configuration fields, not just `kmsKeyId`, so you may want to first `get_guardrail` and reuse its config.

        ***

        ## 5. Verify encryption setting

        Use `get_guardrail` and confirm `kmsKeyId` is set:

        ```python theme={null}
        resp = bedrock.get_guardrail(
            guardrailIdentifier=guardrail_arn,
            guardrailVersion="DRAFT"
        )

        print("kmsKeyId:", resp.get("kmsKeyId"))
        ```

        If this value is your CMK ARN/alias, the guardrail is now using customer-managed keys for encryption.
      </Accordion>
    </AccordionGroup>
  </Tab>
</Tabs>