No Bedrock guardrails configured

Severity: High
Service: Bedrock
Check ID: BEDROCK_NO_GUARDRAILS

What this check finds

No guardrails are configured in Amazon Bedrock. Guardrails block harmful content, PII leakage, and topic misuse in model interactions.

Passing looks like: Bedrock guardrails configured.

How to fix it

Create a guardrail: Bedrock console → Guardrails → Create guardrail. Apply to all model invocations in your application.

Compliance controls it is evidence for

A failing result counts against these controls in KloudLytics; a passing one is evidence towards them. How compliance mapping works

Compliance controls mapped to No Bedrock guardrails configured
Framework	Controls
PCI-DSS v4.0.1	10.7 Failures of critical security control systems are detected, reported, and responded to promptly
HIPAA Security Rule	164.308(a)(5) Security Awareness — Protection from Malicious Software
SOC 2 — Trust Services Criteria	CC7.1 Threat and Vulnerability Detection
NIST SP 800-53 Rev5 (Moderate)	SI-4 System Monitoring
NIST Cybersecurity Framework 2.0	DE.CM-01 Networks are monitored
ISO/IEC 27001:2022 Annex A	A.8.16 Monitoring activities

AI risk mappings

AI risk taxonomies mapped to No Bedrock guardrails configured
Framework	Controls
OWASP Top 10 for LLM Applications (2025)	LLM01 Prompt Injection LLM05 Improper Output Handling
MITRE ATLAS (Adversarial Threat Landscape for AI Systems)	AML.T0051 LLM Prompt Injection

Checked on every scan

KloudLytics runs this check each time it scans a connected AWS account, through a read-only role, and lists every affected resource with its region. On Pro and Business a fix is written for the specific resource rather than the general case above. The exact access it needs

More Bedrock checks

All Bedrock checks