---
title: >-
  IAM user inline policies should enforce Bedrock Guardrails at runtime
  invocation
description: Datadog, the leading service for cloud-scale monitoring.
breadcrumbs: >-
  Docs > Datadog Security > OOTB Rules > IAM user inline policies should enforce
  Bedrock Guardrails at runtime invocation
---

# IAM user inline policies should enforce Bedrock Guardrails at runtime invocation
 
## Description{% #description %}

This control checks whether your IAM user inline policies for Bedrock invocation actions require Bedrock Guardrails to be attached. Without this requirement, callers can bypass Bedrock Guardrails at runtime.

The control fails if the policy allows any of the following actions without a condition requiring a Guardrail:

- `bedrock:InvokeModel`
- `bedrock:InvokeModelWithResponseStream`
- `bedrock:Converse`
- `bedrock:InvokeAgent`
- `bedrock:*`
- `*`

The control specifically verifies the presence of guardrail conditions, such as `GuardrailIdentifier`, ensuring that protective measures are in place.

## Remediation{% #remediation %}

See the [IAM JSON Policy Elements: Condition](https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition.html) and [Modifying Inline Policies for Users](https://docs.aws.amazon.com/IAM/latest/UserGuide/access_policies_manage-edit.html#editing-inline-policies-userconsole) documentation for guidance on modifying policies to include necessary guardrail conditions.