Bedrock Guardrail Should Have Sensitive Information Filters

More Info:

Bedrock guardrail should have sensitive information filters (piiEntities & regexes)

Risk Level

High

Address

Security

Compliance Standards

• APRA CPS 234 (Australia)
• BSI C5 (Germany)
• Brazil LGPD
• CCPA / CPRA (California)
• CIS Critical Security Controls v8
• CMMC 2.0
• DPDPA
• Digital Operational Resilience Act (EU)
• ISO/IEC 27018
• ISO/IEC 27701
• MAS Technology Risk Management (Singapore)
• MITRE ATT&CK (Cloud)
• NIST SP 800-171
• NYDFS 23 NYCRR 500
• SOC2
• SWIFT Customer Security Controls Framework
• Sarbanes-Oxley IT General Controls
• StateRAMP
• UK NCSC Cyber Assessment Framework

Triage and Remediation

Remediation

Remediation

Using Console

To remediate “Bedrock Guardrail should have Sensitive Information Filters” using the AWS Console, you either need to add or enable sensitive information filters on the relevant guardrail.

Below are step‑by‑step instructions.

---

1. Open the Guardrail in the AWS Console

1. Sign in to the AWS Management Console.
2. Go to Amazon Bedrock:
   • In the search bar, type Bedrock and choose Amazon Bedrock.
3. In the left navigation pane, select Guardrails.
4. Locate the guardrail you want to fix:
   • Use the search bar or filter by name/ID.
5. Click the guardrail name to open its details.
6. Click Edit (top right).

---

2. Enable Sensitive Information Filters

1. In the edit flow, go to the Sensitive information (or Sensitive information filters) section.
2. Turn on the toggle for Sensitive information filters if it is off.

You now need to configure what to block/mask.

---

3. Add Built‑in Sensitive Information Filters (PII, etc.)

1. Under Built-in sensitive information types (wording may vary slightly):
   • Click Add type or Manage types.
2. From the list of built‑in types (examples: Email address, Phone number, Credit card number, Bank account number, etc.), select those you want to detect.
   • At a minimum, select common PII relevant to your use case:
     • Names
     • Email addresses
     • Phone numbers
     • Physical addresses
     • National IDs (e.g., SSN if applicable to your region)
     • Financial identifiers (credit card, bank account)
3. For each selected type, choose the action:
   • Block – reject content containing that information.
   • Mask – redact the sensitive parts (e.g., replace with a placeholder).
4. Save or confirm your selection.

---

4. (Optional) Add Custom Sensitive Information Rules

Use this if you have custom patterns (e.g., internal IDs).

1. In the same Sensitive information section, find Custom sensitive information (or similar).
2. Click Add pattern / Create rule.
3. Provide:
   • Name and Description.
   • Pattern type: usually Regular expression.
   • Regex pattern that matches your internal ID / secret format.
4. Choose the action (Block or Mask).
5. Click Add or Save.

---

5. Configure Input vs Output Handling

1. In the Sensitive information section, verify how detection is applied:
   • Inputs: detection on user prompts/messages.
   • Outputs: detection on model responses.
2. Ensure filters are enabled where needed:
   • For most compliance use cases, enable for both inputs and outputs.
3. Adjust actions:
   • For example, block outputs that reveal PII; possibly mask PII in inputs.

---

6. Save and Activate the Updated Guardrail

1. Review all changes on the summary page.
2. Click Save or Save changes.
3. Ensure the guardrail is in an Active or equivalent status.

---

7. Confirm Guardrail Association

Make sure workloads are actually using this guardrail:

1. In Amazon Bedrock:
   • For Agents:
     • Go to Agents, open your agent, and verify under Guardrails that this guardrail (and version) is selected.
   • For Direct model invocation (via API/console playground):
     • In the console Playground, select your model.
     • Under Guardrails, choose this guardrail and the correct version.
2. Save any agent configuration changes.

---

8. Quick Validation

1. Go to the Playground for the model with this guardrail attached.
2. Enter a prompt containing obvious PII (e.g., a fake email or phone number).
3. Confirm the response is:
   • Blocked, or
   • Masked/redacted, according to your settings.

Once these filters are enabled and validated, the misconfiguration “Bedrock Guardrail Should Have Sensitive Information Filters” is remediated.

Using CLI

Below are step‑by‑step AWS CLI instructions to ensure an AWS Bedrock Guardrail has Sensitive Information Filters configured.

Assumptions:

• You already have a guardrail created (with a Guardrail ID and version).
• AWS CLI v2 is installed and configured with appropriate IAM permissions for Bedrock Guardrails.

---

1. Identify the Guardrail to Fix

aws bedrock list-guardrails

From the output, note:

• guardrailId
• the latest version (e.g., "1")

If you don’t know the version, you can also inspect a specific guardrail:

aws bedrock get-guardrail \
  --guardrail-identifier <YOUR_GUARDRAIL_ID> \
  --guardrail-version <VERSION_NUMBER>

Save the output to a file to edit:

aws bedrock get-guardrail \
  --guardrail-identifier <YOUR_GUARDRAIL_ID> \
  --guardrail-version <VERSION_NUMBER> \
  > guardrail-current.json

---

2. Prepare a Guardrail Configuration with Sensitive Information Filters

Create a new JSON file, e.g. guardrail-update.json.
You must include all required fields for update-guardrail, not only the new section.

Minimal example with PII entities and custom regex filters:

{
  "name": "my-guardrail",
  "description": "Guardrail with sensitive information filters",
  "topicPolicyConfig": {
    "topicsConfig": []
  },
  "contentPolicyConfig": {
    "filtersConfig": []
  },
  "sensitiveInformationPolicyConfig": {
    "piiEntitiesConfig": [
      {
        "type": "EMAIL",
        "action": "BLOCK"
      },
      {
        "type": "PHONE",
        "action": "BLOCK"
      },
      {
        "type": "NAME",
        "action": "BLOCK"
      }
    ],
    "regexesConfig": [
      {
        "name": "SSNDetector",
        "description": "US Social Security Number pattern",
        "pattern": "\\b\\d{3}-\\d{2}-\\d{4}\\b",
        "action": "BLOCK"
      },
      {
        "name": "CreditCardDetector",
        "description": "Basic credit card pattern (simple example)",
        "pattern": "\\b(?:\\d[ -]*?){13,16}\\b",
        "action": "BLOCK"
      }
    ]
  },
  "blockedInputMessaging": "Your input appears to contain sensitive information and has been blocked.",
  "blockedOutputsMessaging": "The model output contained sensitive information and has been blocked."
}

Notes:

• piiEntitiesConfig.type values include common PII types such as EMAIL, PHONE, NAME, ADDRESS, etc. (use the ones you need).
• action is typically "BLOCK" for strict enforcement.
• pattern must be a valid JSON string (escape backslashes).

If you have existing topic/content configs from guardrail-current.json, copy them into this file so you don’t overwrite them with empty values.

---

3. Update the Guardrail to Add Sensitive Information Filters

aws bedrock update-guardrail \
  --guardrail-identifier <YOUR_GUARDRAIL_ID> \
  --cli-input-json file://guardrail-update.json

The response will include a new version. Note it.

---

4. (Optional) Set the New Version as Default

If you want this updated version used by default:

aws bedrock put-guardrail-version \
  --guardrail-identifier <YOUR_GUARDRAIL_ID> \
  --guardrail-version <NEW_VERSION_NUMBER> \
  --status ACTIVE

---

5. Verify Sensitive Information Filters Are Active

aws bedrock get-guardrail \
  --guardrail-identifier <YOUR_GUARDRAIL_ID> \
  --guardrail-version <NEW_VERSION_NUMBER>

Confirm:

• sensitiveInformationPolicyConfig.piiEntitiesConfig is present and correctly set.
• sensitiveInformationPolicyConfig.regexesConfig is present and correctly set.

---

If you paste your current get-guardrail JSON (redacting sensitive IDs), I can show you the exact patch to apply.

Using Python

To remediate “Bedrock Guardrail should have sensitive information filters” you need to create or update the Guardrail so that sensitiveInformationFilteringConfiguration is enabled and properly configured.

Below is a concise, step‑by‑step guide using Python (boto3).

---

1. Prerequisites

1. Install/upgrade boto3:

   pip install --upgrade boto3

2. Configure AWS credentials with permissions for Bedrock Guardrails:
   • bedrock:CreateGuardrail
   • bedrock:UpdateGuardrail
   • bedrock:GetGuardrail
   • bedrock:ListGuardrails

---

2. Understand the Guardrail Sensitive Info Structure

Bedrock Guardrails have this block:

"sensitiveInformationPolicyConfig": {
  "piiEntitiesConfig": [
    {
      "type": "EMAIL",
      "action": "ANONYMIZE"
    }
  ],
  "regexConfig": [
    {
      "name": "Custom-SSN",
      "pattern": "\\b\\d{3}-\\d{2}-\\d{4}\\b",
      "action": "BLOCK"
    }
  ]
}

• piiEntitiesConfig – built‑in PII types (EMAIL, PHONE, CREDIT_CARD, etc.).
• regexConfig – your own patterns.
• action – commonly BLOCK or ANONYMIZE.

---

3. If You’re Creating a New Guardrail with Sensitive Info Filters

import boto3
import json

client = boto3.client("bedrock")

response = client.create_guardrail(
    name="my-guardrail-with-sensitive-filters",
    description="Guardrail with PII filtering",
    blockedInputMessaging="Your input was blocked due to sensitive content.",
    blockedOutputsMessaging="Model output was blocked due to sensitive content.",
    sensitiveInformationPolicyConfig={
        "piiEntitiesConfig": [
            {
                "type": "EMAIL",      # built-in PII entity
                "action": "ANONYMIZE" # or "BLOCK"
            },
            {
                "type": "PHONE",
                "action": "ANONYMIZE"
            }
        ],
        "regexConfig": [
            {
                "name": "Custom-SSN",
                "pattern": r"\b\d{3}-\d{2}-\d{4}\b",
                "action": "BLOCK"
            }
        ]
    },
    # You can add other guardrail configs here (contentPolicyConfig, etc.)
)

print(json.dumps(response, indent=2, default=str))

Note: Check the AWS Bedrock Guardrails docs for the latest valid type values for piiEntitiesConfig.

---

4. If You Already Have a Guardrail and Need to Add Filters

1. Get the current Guardrail configuration.
2. Merge or add the sensitive information policy section.
3. Call update_guardrail.

import boto3
import json

client = boto3.client("bedrock")

guardrail_id = "gr-xxxxxxxx"  # your existing guardrail ID
guardrail_version = "DRAFT"   # typically modify DRAFT; publish later

# 1. Fetch existing configuration
current = client.get_guardrail(
    guardrailIdentifier=guardrail_id,
    guardrailVersion=guardrail_version
)

# 2. Build the sensitive information policy config
new_sensitive_config = {
    "piiEntitiesConfig": [
        {"type": "EMAIL", "action": "ANONYMIZE"},
        {"type": "PHONE", "action": "ANONYMIZE"},
        {"type": "CREDIT_CARD", "action": "BLOCK"}
    ],
    "regexConfig": [
        {
            "name": "Custom-Account-Number",
            "pattern": r"\b[0-9]{10}\b",
            "action": "BLOCK"
        }
    ]
}

# 3. Call update_guardrail to apply the new policy
response = client.update_guardrail(
    guardrailIdentifier=guardrail_id,
    name=current["name"],
    description=current.get("description", ""),
    blockedInputMessaging=current.get("blockedInputMessaging", ""),
    blockedOutputsMessaging=current.get("blockedOutputsMessaging", ""),
    sensitiveInformationPolicyConfig=new_sensitive_config,
    # Re‑pass other existing sections if needed:
    contentPolicyConfig=current.get("contentPolicyConfig"),
    # add additional configs that your guardrail uses (topicPolicyConfig, wordPolicyConfig, etc.)
)

print(json.dumps(response, indent=2, default=str))

---

5. (Optional) Publish the Updated Guardrail Version

Once satisfied:

publish_resp = client.create_guardrail_version(
    guardrailIdentifier=guardrail_id
)
print(json.dumps(publish_resp, indent=2, default=str))

You then reference the new version in your Bedrock runtime calls.

---

This ensures the guardrail has active Sensitive Information Filters (both built‑in PII entities and optional custom regex), resolving the misconfiguration.

Using Terraform

resource "aws_bedrock_guardrail" "THIS_GUARDRAIL" {
  # Substitute with your guardrail values
  name        = "GUARDRAIL_NAME"
  description = "GUARDRAIL_DESCRIPTION"

  # ... any existing configuration such as topic_policy_config, content_policy_config, etc. ...

  # Add sensitive information filters equivalent to:
  # aws bedrock update-guardrail --sensitive-information-policy-config '{"piiEntitiesConfig":[{"type":"EMAIL","action":"BLOCK"},{"type":"PHONE","action":"BLOCK"}],"regexesConfig":[]}'
  #
  # WARNING: This block replaces any existing sensitive information policy on this guardrail.
  # If you already have PII entities or regexes configured, merge them here to avoid losing them.
  sensitive_information_policy_config {
    pii_entities_config {
      type   = "EMAIL"
      action = "BLOCK"
    }

    pii_entities_config {
      type   = "PHONE"
      action = "BLOCK"
    }

    # regexes_config is intentionally omitted, matching regexesConfig: [] from the CLI example.
    # Add regexes_config blocks here if you need custom regex-based filters.
  }
}

This change updates the guardrail in place; it should not force replacement of the aws_bedrock_guardrail resource, but it will overwrite any previously configured sensitive information policy.

To verify, terraform plan should show an in-place ~ update on aws_bedrock_guardrail.THIS_GUARDRAIL with sensitive_information_policy_config changing from its current value to include the two pii_entities_config entries and no regexes_config.