IAM group inline policies should enforce Bedrock Guardrails at runtime invocation

문서 > Datadog 보안 > OOTB Rules > IAM group inline policies should enforce Bedrock Guardrails at runtime invocation

이 페이지는 아직 영어로 제공되지 않습니다. 번역 작업 중입니다.
현재 번역 프로젝트에 대한 질문이나 피드백이 있으신 경우 언제든지 연락주시기 바랍니다.

Description

This control checks whether your IAM group inline policies for Bedrock invocation actions require Bedrock Guardrails to be attached. Without this requirement, callers can bypass Bedrock Guardrails at runtime.

The control fails if the policy allows any of the following actions without a condition requiring a Guardrail:

bedrock:InvokeModel
bedrock:InvokeModelWithResponseStream
bedrock:Converse
bedrock:InvokeAgent
bedrock:*
*

The control specifically verifies the presence of guardrail conditions, such as GuardrailIdentifier, ensuring that protective measures are in place.

Remediation

See the IAM JSON Policy Elements: Condition and Modifying Inline Policies for Groups documentation for guidance on modifying policies to include necessary guardrail conditions.