Question

A financial services company runs multiple GenAI applications across several teams, each invoking Amazon Bedrock foundation models with their own IAM roles. The security team wants to guarantee that every single InvokeModel and Converse call in the account is evaluated against a mandatory, centrally-managed guardrail, regardless of whether individual developers remember to attach a guardrailIdentifier parameter in their API calls. Which approach enforces this requirement most reliably?

Accepted Answer

Attach an IAM policy to every developer role that includes a Deny statement on bedrock:InvokeModel unless the bedrock:GuardrailIdentifier condition key matches the approved guardrail ARN and version.

Answer

Publish a runbook instructing all teams to pass the guardrailIdentifier and guardrailVersion parameters in every InvokeModel and Converse request.

Answer

Enable Bedrock model invocation logging to CloudWatch and create an alarm that fires whenever a request is made without a guardrail applied.

Answer

Create the guardrail and set it as the account default in the Bedrock console so it is automatically applied to all model invocations.