Amazon Bedrock-Buardrails announces that IAM's application to offer safe interactions of AI

As the generative adoption of ai is accelerated among companies, the maintenance of safe, responsible and compatible interactions has never been more critical. amazon Bedrock Guardrails provides configurable safeguards that help organizations to build generative applications with leadership protection leaders in the industry. With amazon Bedrock Guardrails, you can implement safeguards in your generative applications of ai that are customized to their use cases and policies of the responsible. You can create multiple railings adapted to different cases of use and apply them through multiple base models (FMS), improving user experiences and standardizing security controls in generative applications of ai. Beyond amazon's mother rock models, the service offers the Flexible API applied that allows you to evaluate the text using your preconfigured railings without invoking FMS, which allows you to implement safety controls in generative ai applications, either running in amazon rock or in other systems, both in the input levels and output.

Today, we are announcing a significant improvement for amazon's mother rock railings: the application of AWS identity and access management policies (IAM). This powerful capacity allows safety and compliance equipment to establish mandatory railings for each models inference call, ensuring that organizational security policies are constantly applied in ai interactions. This characteristic improves ai governance by enabling centralized control over the implementation of railings.

Challenges with the construction of generative applications of ai

Organizations that implement generative ai face critical governance challenges: content adaptation, where models can produce undesirable responses to problematic indications; Security concerns, with a potential generation of harmful content even of innocent indications; Privacy protection requirements to handle confidential information; and application of policies consisting of IA implementations.

Perhaps the most challenging is to ensure that appropriate safeguards are applied consistently through the interactions of ai within an organization, regardless of which equipment or individual is developing or implementing applications.

amazon Bedrock -Buardrails capacities

amazon Bedrock -Buardrails allows you to implement safeguards in personalized generative generative applications for their specific and political use cases. Guardrails currently admits six types of policies:

• Content filters – Configurable thresholds in six harmful categories: hate, insults, sexual, violence, misconduct and rapid injections
• Denied themes – Definition of specific topics that should be avoided in the context of an application
• Confidential Information Filters – Detection and elimination of personal identification information (PII) and custom regular entities to protect user privacy
• Word filters – Blocking of specific words in generative applications of ai, such as harmful words, blasphemies or names and products of competition
• Contextual grounding verifications – Detection and filtering of hallucinations in the responses of the model verifying whether the answer is based correctly on the reference source provided and relevant to the user consultation
• Automated reasoning -Prevention of factual hallucinations errors using a mathematical sound and algorithmic verification and reasoning verification processes

Policy -based railroad control

Security equipment often have organization requirements to enforce amazon's mother rock rails for each inference call to amazon Bedrock. To support this requirement, amazon's mother rock railings provide the new IAM condition key bedrock:GuardrailIdentifierwhich can be used in IAM policies to enforce the use of a specific railing for the inference of the model. The Condition key in the IAM policy can be applied to the following API:

The following diagram illustrates the policy -based workflow.

If the railing configured in its IAM policy does not match the railing specified in the application, the application will be rejected with an exception of denied access, which applies compliance with organizational policies.

Policy examples

In this section, we present several examples of policies that demonstrate how to enforce the rails for the inference of the model.

Example 1: enforce the use of a specific railing and its numerical version

The following example illustrates the application of exampleguardrail and its numerical version 1 during the inference of the model:

{
    "Version": "2012-10-17",
    "Statement": (
        {
            "Sid": "InvokeFoundationModelStatement1",
            "Effect": "Allow",
            "Action": (
                "bedrock:InvokeModel",
                "bedrock:InvokeModelWithResponseStream"
            ),
            "Resource": (
                "arn:aws:bedrock:region::foundation-model/*"
            ),
            "Condition": {
                "StringEquals": {
                    "bedrock:GuardrailIdentifier": "arn:aws:bedrock:::guardrail/exampleguardrail:1"
                }
            }
        },
        {
            "Sid": "InvokeFoundationModelStatement2",
            "Effect": "Deny",
            "Action": (
                "bedrock:InvokeModel",
                "bedrock:InvokeModelWithResponseStream"
            ),
            "Resource": (
                "arn:aws:bedrock:region::foundation-model/*"
            ),
            "Condition": {
                "StringNotEquals": {
                    "bedrock:GuardrailIdentifier": "arn:aws:bedrock:::guardrail/exampleguardrail:1"
                }
            }
        },
        {
            "Sid": "ApplyGuardrail",
            "Effect": "Allow",
            "Action": (
                "bedrock:ApplyGuardrail"
            ),
            "Resource": (
                "arn:aws:bedrock:::guardrail/exampleguardrail"
            )
        }
    )
}

The additional explicit name denies the user's request to call the actions listed with other GuardrailIdentifier and GuardrailVersion values ​​regardless of other permits that the user can have.

Example 2: enforce the use of a specific railing and its draft version

The following example illustrates the application of exampleguardrail and his draft version during the inference of the model:

{
    "Version": "2012-10-17",
    "Statement": (
        {
            "Sid": "InvokeFoundationModelStatement1",
            "Effect": "Allow",
            "Action": (
                "bedrock:InvokeModel",
                "bedrock:InvokeModelWithResponseStream"
            ),
            "Resource": (
                "arn:aws:bedrock:region::foundation-model/*"
            ),
            "Condition": {
                "StringEquals": {
                    "bedrock:GuardrailIdentifier": "arn:aws:bedrock:::guardrail/exampleguardrail"
                }
            }
        },
        {
            "Sid": "InvokeFoundationModelStatement2",
            "Effect": "Deny",
            "Action": (
                "bedrock:InvokeModel",
                "bedrock:InvokeModelWithResponseStream"
            ),
            "Resource": (
                "arn:aws:bedrock:region::foundation-model/*"
            ),
            "Condition": {
                "StringNotEquals": {
                    "bedrock:GuardrailIdentifier": "arn:aws:bedrock:::guardrail/exampleguardrail"
                }
            }
        },
        {
            "Sid": "ApplyGuardrail",
            "Effect": "Allow",
            "Action": (
                "bedrock:ApplyGuardrail"
            ),
            "Resource": (
                "arn:aws:bedrock:::guardrail/exampleguardrail"
            )
        }
    )
}

Example 3: enforce the use of a specific railing and its numerical versions

The following example illustrates the application of exampleguardrail and its numerical versions during the inference of the model:

{
    "Version": "2012-10-17",
    "Statement": (
        {
            "Sid": "InvokeFoundationModelStatement1",
            "Effect": "Allow",
            "Action": (
                "bedrock:InvokeModel",
                "bedrock:InvokeModelWithResponseStream"
            ),
            "Resource": (
                "arn:aws:bedrock:region::foundation-model/*"
            ),
            "Condition": {
                "StringLike": {
                    "bedrock:GuardrailIdentifier": "arn:aws:bedrock:::guardrail/exampleguardrail:*"
                }
            }
        },
        {
            "Sid": "InvokeFoundationModelStatement2",
            "Effect": "Deny",
            "Action": (
                "bedrock:InvokeModel",
                "bedrock:InvokeModelWithResponseStream"
            ),
            "Resource": (
                "arn:aws:bedrock:region::foundation-model/*"
            ),
            "Condition": {
                "StringNotLike": {
                    "bedrock:GuardrailIdentifier": "arn:aws:bedrock:::guardrail/exampleguardrail:*"
                }
            }
        },
        {
            "Sid": "ApplyGuardrail",
            "Effect": "Allow",
            "Action": (
                "bedrock:ApplyGuardrail"
            ),
            "Resource": (
                "arn:aws:bedrock:::guardrail/exampleguardrail"
            )
        }
    )
}

Example 4: enforce the use of a specific railing and its versions, including the draft

The following example illustrates the application of exampleguardrail and its versions, including the draft, during the inference of the model:

{
    "Version": "2012-10-17",
    "Statement": (
        {
            "Sid": "InvokeFoundationModelStatement1",
            "Effect": "Allow",
            "Action": (
                "bedrock:InvokeModel",
                "bedrock:InvokeModelWithResponseStream"
            ),
            "Resource": (
                "arn:aws:bedrock:region::foundation-model/*"
            ),
            "Condition": {
                "StringLike": {
                    "bedrock:GuardrailIdentifier": "arn:aws:bedrock:::guardrail/exampleguardrail*"
                }
            }
        },
        {
            "Sid": "InvokeFoundationModelStatement2",
            "Effect": "Deny",
            "Action": (
                "bedrock:InvokeModel",
                "bedrock:InvokeModelWithResponseStream"
            ),
            "Resource": (
                "arn:aws:bedrock:region::foundation-model/*"
            ),
            "Condition": {
                "StringNotLike": {
                    "bedrock:GuardrailIdentifier": "arn:aws:bedrock:::guardrail/exampleguardrail*"
                }
            }
        },
        {
            "Sid": "ApplyGuardrail",
            "Effect": "Allow",
            "Action": (
                "bedrock:ApplyGuardrail"
            ),
            "Resource": (
                "arn:aws:bedrock:::guardrail/exampleguardrail"
            )
        }
    )
}

Example 5: Comply with the use of a railing and a couple of specific versions of a list of mud bars and versions pairs

The following example illustrates the application of exampleguardrail1 and its version 1, or exampleguardrail2 and its version 2, or exampleguardrail3 and its version 3 and its draft during the inference of the model:

{
    "Version": "2012-10-17",
    "Statement": (
        {
            "Sid": "InvokeFoundationModelStatement1",
            "Effect": "Allow",
            "Action": (
                "bedrock:InvokeModel",
                "bedrock:InvokeModelWithResponseStream"
            ),
            "Resource": (
                "arn:aws:bedrock:region::foundation-model/*"
            ),
            "Condition": {
                "StringEquals": {
                    "bedrock:GuardrailIdentifier": (
                        "arn:aws:bedrock:::guardrail/exampleguardrail1:1",
                        "arn:aws:bedrock:::guardrail/exampleguardrail2:2",
                        "arn:aws:bedrock:::guardrail/exampleguardrail3"
                    )
                }
            }
        },
        {
            "Sid": "InvokeFoundationModelStatement2",
            "Effect": "Deny",
            "Action": (
                "bedrock:InvokeModel",
                "bedrock:InvokeModelWithResponseStream"
            ),
            "Resource": (
                "arn:aws:bedrock:region::foundation-model/*"
            ),
            "Condition": {
                "StringNotEquals": {
                    "bedrock:GuardrailIdentifier": (
                        "arn:aws:bedrock:::guardrail/exampleguardrail1:1",
                        "arn:aws:bedrock:::guardrail/exampleguardrail2:2",
                        "arn:aws:bedrock:::guardrail/exampleguardrail3"
                    )
                }
            }
        },
        {
            "Sid": "ApplyGuardrail",
            "Effect": "Allow",
            "Action": (
                "bedrock:ApplyGuardrail"
            ),
            "Resource": (
                "arn:aws:bedrock:::guardrail/exampleguardrail1",
                "arn:aws:bedrock:::guardrail/exampleguardrail2",
                "arn:aws:bedrock:::guardrail/exampleguardrail3"
            )
        }
    )
}

Known limitations

When implementing the application of the policy -based railing, consider these limitations:

• At the time of writing this article, amazon's mother rock railings do not support resource -based policies for access to the cross account.
• If a user assumes a role that has a specific railing configured using the bedrock:GuardrailIdentifier Condition key, the user can strategically use input labels to help prevent railing controls from being applied to certain parts of their message. Input labels allow users to mark specific text sections that must be processed by railings, leaving other unprocessed sections. For example, a user could intentionally leave sensitive or potentially harmful content outside the sections labeled, preventing those portions from being evaluated against rail policies. However, regardless of how the warning is structured or labeled, the railing will still be fully applied to the model's response.
• If a user has a configured role with a specific railing requirement (using the bedrock:GuardrailIdentifier condition), should not use that same role to access services such as amazon Bedrock Knowledge Bases RetrieveAndGenerate o amazon rock bed agents InvokeAgent. These higher level services work by making multiple InvokeModel You call behind the user's name. Although some of these calls may include the required railing, others do not. When the system tries to make these free calls using a role that requires railings, it results in AccessDenied Errors, breaking the functionality of these services. To help avoid this problem, organizations must separate permits, using different roles for access to the direct model with railings versus access to these services composed of amazon's mother rock.

Conclusion

The new application of railing based on IAM policies on amazon Bedrock represents a crucial advance in ai governance as the generative ai is integrated into commercial operations. By enabling the application of centralized policies, security equipment can maintain security controls consisting of ai applications, regardless of who develops or deployment, effectively mitigating the risks related to harmful content, violations of privacy and bias. This approach offers significant advantages: scale efficiently as organizations expand their IA initiatives without creating administrative bottlenecks, it helps prevent technical debt by standardizing security implementations and improving the developer's experience by allowing equipment to focus on innovation instead of compliance mechanics.

This capacity demonstrates the organizational commitment to the practices of the responsible through comprehensive monitoring and auditing mechanisms. Organizations can use the Model Invocation Registry in amazon's rock to capture complete data and response data in amazon Cloudwatch records or amazon Simorage Service amazon Cubes (amazon S3), including the specific documentation of railing traces that shows when and how the content was filtered. Combined with the integration of cloudtrail AWS that records railings of railings and policy application actions, companies can conflict their generative initiatives of ai with appropriate security mechanisms that protect their brand, customers and data, which makes the essential balance between innovation and ethical responsibility necessary to generate confidence in ai systems.

Start with amazon's mother rock railings and implement configurable safeguards that balance innovation with the governance of the responsible throughout its organization.

About the authors

Sryam Srinivasan It is in the amazon mother rock railing products team. He cares about making the world a better place through technology and loves to be part of this trip. In his free time, Shyam likes to run long distances, travel around the world and experience new cultures with family and friends.

Antonio Rodríguez He is a main architect of generative solutions in AWS. It helps companies with all sizes to solve their challenges, adopt innovation and create new business opportunities with amazon Bedrock. In addition to work, he loves spending time with his family and practicing sports with his friends.

Satveer Khurpa He is an architect of specialist solutions at the WW, amazon Bedrock on amazon Web Services. In this role, it uses its experience in cloud -based architectures to develop innovative generative generative solutions for customers in various industries. The deep understanding of satveer of generative technologies of ai allows you to design scalable, safe and responsible applications that unlock new commercial opportunities and drive tangible value.