IAM group inline policies should enforce Bedrock Guardrails at runtime invocation

bedrock
Cette page n'est pas encore disponible en français, sa traduction est en cours.
Si vous avez des questions ou des retours sur notre projet de traduction actuel, n'hésitez pas à nous contacter.

Description

This control checks whether your IAM group inline policies for Bedrock invocation actions require Bedrock Guardrails to be attached. Without this requirement, callers can bypass Bedrock Guardrails at runtime.

The control fails if the policy allows any of the following actions without a condition requiring a Guardrail:

  • bedrock:InvokeModel
  • bedrock:InvokeModelWithResponseStream
  • bedrock:Converse
  • bedrock:InvokeAgent
  • bedrock:*
  • *

The control specifically verifies the presence of guardrail conditions, such as GuardrailIdentifier, ensuring that protective measures are in place.

Remediation

See the IAM JSON Policy Elements: Condition and Modifying Inline Policies for Groups documentation for guidance on modifying policies to include necessary guardrail conditions.