Profile Applicability:
- Level 2
Description:
Amazon Bedrock provides a managed environment for building and deploying generative AI applications. Guardrails are security features within Amazon Bedrock that help ensure the safe operation of agent sessions. Guardrails enforce policies to block or filter any malicious or inappropriate prompts during interactions with AI models. Enabling guardrails for Amazon Bedrock agent sessions ensures that any requests to the model adhere to security standards and prevent prompt injection, manipulation, or any malicious activity.
This SOP outlines the process for ensuring that guardrails are enabled for Amazon Bedrock agent sessions, offering an added layer of security and compliance for AI applications.
Rationale:
Security: Enabling guardrails helps to protect against potential threats such as prompt injections or adversarial inputs that could exploit the model's responses.
Compliance: Many compliance frameworks, including HIPAA, PCI-DSS, and SOC 2, require AI-driven systems to implement robust security and safety measures. Guardrails help meet these standards.
Operational Integrity: Guardrails prevent the model from generating unintended or harmful outputs, ensuring that the AI operates within safe and predefined parameters.
Impact:
Pros:
Improved Security: Guardrails mitigate the risk of malicious actors exploiting AI models through harmful prompts.
Operational Safety: Ensures the model behaves predictably, reducing the chances of generating harmful, biased, or incorrect outputs.
Compliance: Helps meet security and regulatory requirements, ensuring the model operates within safe boundaries.
Cons:
Potential False Positives: In certain cases, legitimate requests may be blocked if the guardrails are too stringent.
Performance Overhead: The added layer of security might slightly impact the performance of the agent session, though typically minimal.
Default Value:
Guardrails are disabled by default for Amazon Bedrock agent sessions. You must manually enable them to apply the necessary security policies to the session.
Pre-requisite:
AWS IAM Permissions:
bedrock:DescribeGuardrails
bedrock:UpdateGuardrails
bedrock:CreateGuardrail
AWS CLI installed and configured.
Amazon Bedrock service should be set up and accessible, and you should have an active AI model for which you want to enable guardrails.
Test Plan:
Using AWS Console:
Sign in to the AWS Management Console.
Navigate to Amazon Bedrock under Services.
In the Amazon Bedrock Console, go to the Guardrails section.
Check the status of guardrails for agent sessions:
If guardrails are enabled, they will be listed under the guardrails settings.
If they are disabled, you will need to enable them.
To enable guardrails, select the appropriate AI model and turn on the guardrail settings for agent sessions.
Save the configuration and confirm that guardrails are applied to the agent sessions.
Using AWS CLI:
To check if guardrails are enabled for agent sessions, run:
aws bedrock describe-guardrails --query 'Guardrails[*].{GuardrailId:GuardrailId,AgentSessionGuardrailEnabled:AgentSessionGuardrailEnabled}'Review the output:
If AgentSessionGuardrailEnabled is true, guardrails are enabled for agent sessions.
If AgentSessionGuardrailEnabled is false, guardrails are disabled.
To enable guardrails for agent sessions, run:
aws bedrock update-guardrail --guardrail-id <guardrail-id> --agent-session-guardrail-enabled true
Verify the guardrail settings:
aws bedrock describe-guardrails --query 'Guardrails[*].{GuardrailId:GuardrailId,AgentSessionGuardrailEnabled:AgentSessionGuardrailEnabled}'
Implementation Steps:
Using AWS Console:
Log in to the AWS Management Console and navigate to Amazon Bedrock.
In the Guardrails section, select the AI model for which you wish to enable guardrails.
Turn on the Agent Session Guardrail setting under the Guardrails Configuration section.
Save the changes to enable the guardrails.
Test the AI model to ensure that guardrails are correctly applied and that the model operates as expected.
Using AWS CLI:
Check the status of guardrails by running:
aws bedrock describe-guardrails --query 'Guardrails[*].{GuardrailId:GuardrailId,AgentSessionGuardrailEnabled:AgentSessionGuardrailEnabled}'To enable guardrails for agent sessions, use:
aws bedrock update-guardrail --guardrail-id <guardrail-id> --agent-session-guardrail-enabled true
Verify the guardrail setting by running:
aws bedrock describe-guardrails --query 'Guardrails[*].{GuardrailId:GuardrailId,AgentSessionGuardrailEnabled:AgentSessionGuardrailEnabled}'
Backout Plan:
Using AWS Console:
If enabling Guardrails causes issues, sign in to the AWS Management Console.
Navigate to Amazon Bedrock, select Agent Sessions, and go to the Guardrails configuration.
Disable Guardrails or revert to the previous configuration by modifying or removing the guardrail settings.
Save the changes and verify that Guardrails have been removed or reverted.
Using AWS CLI:
To disable Guardrails for an Agent Session, run:
aws bedrock disable-guardrails --agent-session-arn <AGENT_SESSION_ARN>Verify that Guardrails have been disabled:
aws bedrock describe-guardrails --region <REGION>
