Certopolis

AWS Certified Generative AI Developer – Professional

Guardrails for Amazon Bedrock: which filter to use (AIP-C01)

A guardrail is a set of policies applied to prompts and model responses. Content filters catch harmful categories by strength, denied topics block subjects you define, word filters block exact words, sensitive information filters block or mask PII and regex matches, and grounding and Automated Reasoning checks catch inaccurate responses. Each filter can act differently on input and output.

The policies

Content filters detect Hate, Insults, Sexual, Violence, Misconduct and Prompt Attack in text or images. You set a strength of NONE, LOW, MEDIUM or HIGH separately for prompts (inputStrength) and responses (outputStrength).

Denied topics block subjects that you describe, in user queries or model responses.

Word filters block exact words and phrases with case-insensitive whole-word matching. Add your own words, such as competitor and product names, or turn on the ready-made profanity filter, which AWS keeps updated.

Sensitive information filters block or mask PII such as names, email addresses and SSNs, and can use custom regex patterns for formats like booking IDs. Masking replaces the value with its type, for example {NAME} or {EMAIL}, and the rest of the text is still returned.

Contextual grounding checks flag responses that are not grounded in the source or not relevant to the query. Automated Reasoning checks validate responses against logical rules.

Input action vs output action

Each content filter has an inputAction and an outputAction. BLOCK replaces the content with the blocked message. NONE takes no action but returns what was detected in the trace response.

Example: a telehealth bot blocks patients who describe injuries. Set the Violence filter's inputAction to NONE and keep outputAction at BLOCK, create a new guardrail version, and enable trace so the application can log what the filter saw on each prompt. inputEnabled false would instead skip the evaluation, so nothing would be recorded.

Drafts and versions

A new guardrail has a working draft that you can change and test in the console test window. When it behaves as you want, create a version and reference the guardrail ID and version in inference calls or the ApplyGuardrail API.

Where the exam catches people

  • Believing BLOCK on NAME and EMAIL keeps the summary: BLOCK returns the blocked message. ANONYMIZE masks the values and returns the rest.
  • Believing a custom word list is the way to catch an ID format such as POL- plus eight digits: a regex in the sensitive information filter matches the pattern.
  • Believing you must maintain your own list of profane words: the word filter has a profanity option that AWS keeps updated.
  • Believing inputEnabled false records detections: it skips the evaluation. inputAction NONE evaluates, does not block, and returns detections in the trace.
  • Believing the Misconduct content filter blocks competitor names: exact names belong in a custom word filter.

Written from Amazon Web Services's documentation

Try 3 questions on this

Pick an answer to see why each option is right or wrong.

  1. An insurance company uses an FM on Amazon Bedrock to summarize chats between customers and support agents. The summaries are shared with an analytics team. Customer names and email addresses must be replaced with placeholders in each summary, and the summary must still be returned. Internal policy numbers use the format POL- followed by eight digits and must also be replaced with a placeholder. The company wants a managed control on the model responses. Which combination of steps will meet these requirements with the LEAST operational overhead? (Select TWO)

    Right. In the game that’s Renown for your AI Safety, Security, and Governance building.

    Not that one: C,D is right. In the game your AI Safety, Security, and Governance building would lose a little Renown, and this question would come back later.

    Show the full explanation and doc quotes

    In mask mode, "If sensitive information is detected in the model request or response, the guardrail masks it and replaces it with the PII type", which covers the built-in NAME and EMAIL types. For the internal format, "You can use regular expressions to define patterns for a guardrail to recognize and act upon such as serial number, booking ID, or other custom patterns." Each regex takes its own BLOCK, ANONYMIZE, or NONE action.

    Written from docs.aws.amazon.com/bedrock/latest/userguide/guardrails-sensitive-filters.html

  2. A telehealth company's patient chatbot calls the Converse API with a guardrail from Amazon Bedrock Guardrails. The guardrail's Violence content filter uses HIGH strength with the BLOCK action for both prompts and responses. Patients who describe injuries often have their prompts blocked. The clinical safety team requires three changes. Model responses that the Violence filter flags must still be blocked. Patient prompts must no longer be blocked by the Violence filter. The application must record, for each prompt, what the Violence filter detected so that the team can choose a new prompt strength later. Which combination of steps will meet these requirements? (Select TWO)

    Right. In the game that’s Renown for your AI Safety, Security, and Governance building.

    Not that one: A,E is right. In the game your AI Safety, Security, and Governance building would lose a little Renown, and this question would come back later.

    Show the full explanation and doc quotes

    The API reference describes the NONE action as "NONE – Take no action but return detection information in the trace response." Setting inputAction to NONE while outputAction stays BLOCK stops prompt blocking and keeps response blocking. The detections reach the application only in the trace: the Converse guide says "If you enabled tracing, the trace is available in the trace" field of the response, so the application enables trace and logs each assessment.

    Written from docs.aws.amazon.com/bedrock/latest/APIReference/API_GuardrailContentFilterConfig.html

  3. An automotive retailer runs a customer chat assistant on Amazon Bedrock and applies one guardrail to every Converse request. Marketing rules say that the names of the company's four main competitors and the names of their car models must never appear in customer messages or in responses. Customer messages and responses that contain profane words must also be blocked. The company does not want to write or maintain its own list of profane words. Which combination of steps will meet these requirements? (Select TWO)

    Right. In the game that’s Renown for your AI Safety, Security, and Governance building.

    Not that one: A,D is right. In the game your AI Safety, Security, and Governance building would lose a little Renown, and this question would come back later.

    Show the full explanation and doc quotes

    The word filters page (https://docs.aws.amazon.com/bedrock/latest/userguide/guardrails-word-filters.html) says "Amazon Bedrock Guardrails has word filters that you can use to block words and phrases (exact match) in input prompts and model responses" and that they can block "profanity, offensive, or inappropriate content, or content with competitor or product names." The competitor and model names go in the custom word filter, and the profanity filter covers swearing with a list that AWS maintains: "The list of profanities is based on conventional definitions of profanity and it's continually updated."

    Written from docs.aws.amazon.com/bedrock/latest/userguide/guardrails-word-filters.html