Bedrock custom prompt router has no fallback model configured
- Severity
- Medium
- Service
- Bedrock
- Check ID
- BEDROCK_PROMPT_ROUTER_NO_FALLBACK
What this check finds
A custom Bedrock prompt router does not have a fallback model. If all routed models are unavailable or capacity-constrained, requests will fail with no automatic recovery path.
Passing looks like: Bedrock prompt router has a fallback model.
How to fix it
Edit the prompt router and set a fallback model. Bedrock console → Prompt routers → select router → Edit → Fallback model.
AI risk mappings
| Framework | Controls |
|---|---|
| OWASP Top 10 for LLM Applications (2025) |
|
| MITRE ATLAS (Adversarial Threat Landscape for AI Systems) |
|
Checked on every scan
KloudLytics runs this check each time it scans a connected AWS account, through a read-only role, and lists every affected resource with its region. On Pro and Business a fix is written for the specific resource rather than the general case above. The exact access it needs
More Bedrock checks
- CriticalBedrock agent IAM role has broad permissions
- CriticalBedrock API key belongs to an administrator
- HighBedrock agent has no guardrail applied
- HighBedrock knowledge base not encrypted with CMK
- HighBedrock model invocation logging not enabled
- HighExternal model weights imported into Bedrock without governance review
- HighLong-lived Bedrock API key in use
- HighNo AWS Budget alert configured for Bedrock spend