Bedrock guardrail configured but not enforcing protections

Severity: Medium
Service: Bedrock
Check ID: BEDROCK_GUARDRAIL_INEFFECTIVE

What this check finds

A Bedrock guardrail exists but is missing core protections — no PII/sensitive-information policy, no denied topics, and/or content filters set to NONE strength. A guardrail that enforces nothing gives false assurance against prompt injection, data leakage, and harmful output.

Passing looks like: Bedrock guardrails enforce PII, topic, and content protections.

How to fix it

Strengthen the guardrail: Bedrock console → Guardrails → select guardrail → add a sensitive-information (PII) policy, define denied topics, and set content filters to LOW/MEDIUM/HIGH strength for input and output.

Compliance controls it is evidence for

A failing result counts against these controls in KloudLytics; a passing one is evidence towards them. How compliance mapping works

Compliance controls mapped to Bedrock guardrail configured but not enforcing protections
Framework	Controls
PCI-DSS v4.0.1	10.7 Failures of critical security control systems are detected, reported, and responded to promptly
HIPAA Security Rule	164.308(a)(5) Security Awareness — Protection from Malicious Software
SOC 2 — Trust Services Criteria	CC7.1 Threat and Vulnerability Detection
NIST SP 800-53 Rev5 (Moderate)	SI-4 System Monitoring SI-10 Information Input Validation
NIST Cybersecurity Framework 2.0	PR.PS-02 Software is maintained commensurate with risk DE.CM-01 Networks are monitored
ISO/IEC 27001:2022 Annex A	A.8.16 Monitoring activities A.8.26 Application security requirements

AI risk mappings

AI risk taxonomies mapped to Bedrock guardrail configured but not enforcing protections
Framework	Controls
OWASP Top 10 for LLM Applications (2025)	LLM01 Prompt Injection LLM02 Sensitive Information Disclosure LLM05 Improper Output Handling
MITRE ATLAS (Adversarial Threat Landscape for AI Systems)	AML.T0051 LLM Prompt Injection AML.T0057 LLM Data Leakage

Checked on every scan

KloudLytics runs this check each time it scans a connected AWS account, through a read-only role, and lists every affected resource with its region. On Pro and Business a fix is written for the specific resource rather than the general case above. The exact access it needs

More Bedrock checks

All Bedrock checks