---
schema_version: "1"
id: 307b958aa29008cf4411fa61621cc4d59d5f142fceda3123210d71a7affa29e3
title: Amazon Bedrock Guardrails Policy
collection: mulesoft
version: current
locale: en-us
portal_url: https://docs.salesforce.com/mulesoft/current/en-us/gateway/1.13/policies-included-bedrock-guardrails.md
canonical_url: https://docs.mulesoft.com/gateway/1.13/policies-included-bedrock-guardrails
source_site: docs.mulesoft.com
content_type: documentation
content_hash: c3c5fae0fce078063cca330cf8c273192b2cd6120e5f9834e3d6e7d46b0d7e1f
description: MuleSoft Documentation Site
release: "1.13"
latest: false
---
---
product: Omni Gateway
version: 1.13
keywords: api gateway, flex gateway, gateway, policy, llm, bedrock, guardrails, content safety, pii
---

# Amazon Bedrock Guardrails Policy

> For the full documentation index, see: https://docs.mulesoft.com/llms.txt

<table><colgroup><col> <col></colgroup><tbody><tr><td><p><strong>Policy Name</strong></p></td><td><p>Amazon Bedrock Guardrails Policy</p></td></tr><tr><td><p><strong>Summary</strong></p></td><td><p>Evaluates LLM prompts and responses against Amazon Bedrock guardrails for content safety, PII detection, and contextual grounding</p></td></tr><tr><td><p><strong>Category</strong></p></td><td><p>LLM</p></td></tr><tr><td><p><strong>First Omni Gateway version available</strong></p></td><td><p>v1.13.0</p></td></tr><tr><td><p><strong>Release Notes</strong></p></td><td><p><a href="https://docs.mulesoft.com/release-notes/gateway/policies/bedrock-guardrails-release-notes">Amazon Bedrock Guardrails Policy</a></p></td></tr><tr><td rowspan="2"><p><strong>Returned Status Codes</strong></p></td><td><p>403 - Forbidden: Content violates guardrail policies</p></td></tr><tr><td><p>503 - Service Unavailable: Bedrock API call failed (only when fail-open is disabled)</p></td></tr></tbody></table>

## Summary

The Amazon Bedrock Guardrails policy provides comprehensive content moderation for LLM-based APIs by
evaluating prompts and responses against Amazon Bedrock guardrails. The policy integrates with AWS
Bedrock’s [Guardrails](https://aws.amazon.com/bedrock/guardrails/) feature to enforce content safety
policies including:

The policy supports all Amazon Bedrock Guardrail features:

- **Content filters**: Detects and blocks harmful content across four categories (hate, insults,
  sexual, violence) with configurable filter strengths (NONE, LOW, MEDIUM, HIGH).

- **Denied topics**: Blocks content related to specific topics you define, for example, financial
  advice, medical diagnosis

- **Word filters**: Blocks profanity and custom words or phrases you specify

- **PII detection**: Detects and optionally redacts personally identifiable information, for
  example, names, addresses, SSNs, credit cards

- **Contextual grounding**: Evaluates whether LLM responses are grounded in provided reference text
  and relevant to the user query (hallucination detection)

The guardrail’s configuration is managed entirely in AWS. The policy enforces whatever rules you’ve
configured in the specified guardrail.

The policy operates in two independent phases:

- **Request phase** — Moderates user prompts before they reach the upstream LLM, preventing harmful
  or inappropriate prompts from being processed.

- **Response phase** — Moderates LLM responses before they reach the client, ensuring outputs comply
  with safety policies. Streaming responses (`text/event-stream`) aren’t moderated.

When content violates guardrail policies, the request is rejected with a `403` error code and never
reaches the LLM (request phase) or the client receives a `403` instead of the LLM response (response
phase).

## Before You Begin

Before configuring this policy, you need:

1.  **AWS Account** with access to Amazon Bedrock

2.  **Bedrock Guardrail** created and configured in AWS Console

3.  **IAM Credentials** with permissions to call `bedrock:ApplyGuardrail`

4.  **Guardrail ID** from the AWS Console

## Configuring Policy Parameters

### Omni Gateway Local Mode

The Amazon Bedrock Guardrails policy isn’t supported in Local Mode.

### Managed Omni Gateway and Omni Gateway Connected Mode

When you apply the policy from the UI, the following parameters are displayed:

### Basic Configuration

<table><colgroup><col> <col> <col></colgroup><thead><tr><th>Element</th><th>Required</th><th>Description</th></tr></thead><tbody><tr><td><div><div><p>Bedrock Runtime Endpoint</p></div></div></td><td><div><div><p>Yes</p></div></div></td><td><div><div><p>Amazon Bedrock Runtime endpoint URL. Must match your AWS region, for example: <code>https://bedrock-runtime.us-east-1.amazonaws.com</code>.</p></div></div></td></tr><tr><td><div><div><p>AWS Credentials</p></div></div></td><td><div><div><p>Yes</p></div></div></td><td><div><div><p>AWS credentials and region used for signing requests to the Bedrock API. See <a href="#aws-credentials">AWS Credentials</a>.</p></div></div></td></tr><tr><td><div><div><p>Guardrail Identifier</p></div></div></td><td><div><div><p>Yes</p></div></div></td><td><div><div><p>The unique ID of the Bedrock guardrail to apply (for example, <code>paccgfhgnj1dc</code>).</p></div></div></td></tr><tr><td><div><div><p>Guardrail Version</p></div></div></td><td><div><div><p>No</p></div></div></td><td><div><div><p>Version of the guardrail to apply.</p></div><div><ul><li><p><code>DRAFT</code> (default): Use the working draft version for development and testing</p></li><li><p>Numeric version (for example, <code>"1"</code>, <code>"2"</code>): Use a published version for production deployments</p></li></ul></div></div></td></tr><tr><td><div><div><p>Moderate Request</p></div></div></td><td><div><div><p>No</p></div></div></td><td><div><div><p>When enabled, evaluates the user prompt against the guardrail before forwarding to the upstream LLM. Rejected prompts never reach the LLM.</p></div></div></td></tr><tr><td><div><div><p>Moderate Response</p></div></div></td><td><div><div><p>No</p></div></div></td><td><div><div><p>When enabled, evaluates the LLM response against the guardrail before returning to the client. Rejected responses return <code>403</code> error code.</p></div><div><p><strong>Note:</strong> Streaming responses (<code>text/event-stream</code>) aren’t moderated and pass through unchanged.</p></div></div></td></tr></tbody></table>

### AWS Credentials

The policy uses AWS Signature V4 to authenticate with the Bedrock API. Both long-lived IAM
credentials and temporary STS credentials are supported.

<table><colgroup><col> <col> <col></colgroup><thead><tr><th>Element</th><th>Required</th><th>Description</th></tr></thead><tbody><tr><td><div><div><p>Access Key ID</p></div></div></td><td><div><div><p>Yes</p></div></div></td><td><div><div><p>AWS access key ID. Supports both:</p></div><div><ul><li><p>Long-lived IAM user credentials (starting with <code>AKIA</code>)</p></li><li><p>Temporary credentials from STS or SSO (starting with <code>ASIA</code>)</p></li></ul></div></div></td></tr><tr><td><div><div><p>Secret Access Key</p></div></div></td><td><div><div><p>Yes</p></div></div></td><td><div><div><p>AWS secret access key corresponding to the Access Key ID.</p></div></div></td></tr><tr><td><div><div><p>Session Token</p></div></div></td><td><div><div><p>Conditional</p></div></div></td><td><div><div><p>Required when using temporary credentials (Access Key ID starting with <code>ASIA</code>). Leave empty for long-lived IAM user credentials.</p></div></div></td></tr><tr><td><div><div><p>Region</p></div></div></td><td><div><div><p>Yes</p></div></div></td><td><div><div><p>AWS region of the Bedrock Runtime endpoint (for example, <code>us-east-1</code>). This must match the region in the Bedrock Runtime Endpoint URL.</p></div></div></td></tr></tbody></table>

### Advanced Configuration

<table><colgroup><col> <col> <col></colgroup><thead><tr><th>Element</th><th>Required</th><th>Description</th></tr></thead><tbody><tr><td><div><div><p>Grounding Source Selector</p></div></div></td><td><div><div><p>No</p></div></div></td><td><div><div><p>DataWeave expression that extracts the reference text for contextual grounding from the request body.</p></div><div><p>Required only when contextual grounding is enabled on the AWS guardrail. Must be configured together with Grounding Query Selector.</p></div><div><p>Example: <code>#[payload.messages[0].content]</code></p></div><div><p>See <a href="#contextual-grounding">Contextual Grounding</a> for more information.</p></div></div></td></tr><tr><td><div><div><p>Grounding Query Selector</p></div></div></td><td><div><div><p>No</p></div></div></td><td><div><div><p>DataWeave expression that extracts the user query for contextual grounding from the request body.</p></div><div><p>Required only when contextual grounding is enabled on the AWS guardrail. Must be configured together with Grounding Source Selector.</p></div><div><p>Example: <code>#[payload.messages[-1].content]</code></p></div><div><p>See <a href="#contextual-grounding">Contextual Grounding</a> for more information.</p></div></div></td></tr><tr><td><div><div><p>API Timeout (ms)</p></div></div></td><td><div><div><p>No</p></div></div></td><td><div><div><p>Timeout in milliseconds for calls to the Bedrock <code>ApplyGuardrail</code> API.</p></div><div><ul><li><p>Default: <code>5000</code></p></li><li><p>Range: <code>1000</code> - <code>30000</code></p></li></ul></div></div></td></tr><tr><td><div><div><p>Fail Open</p></div></div></td><td><div><div><p>No</p></div></div></td><td><div><div><p>Determines behavior when the Bedrock API call fails or times out:</p></div><div><ul><li><p>Disabled (default): Rejects the request with HTTP <code>503</code></p></li><li><p>Enabled: Allows traffic to proceed unmoderated (fail-open mode)</p></li></ul></div></div></td></tr></tbody></table>

## How This Policy Works

The Amazon Bedrock Guardrails policy integrates with AWS Bedrock’s content moderation service to
evaluate LLM prompts and responses against configurable safety policies.

### Request and Response Moderation

The policy supports independent evaluation for requests and responses. The two phases mirror AWS
Bedrock’s INPUT and OUTPUT scopes, enabling you to apply different filter strengths to prompts
versus responses when configuring the guardrail in AWS:

1.  **Request Phase** (when `moderateRequest` is enabled):

    1.  The policy extracts the user prompt from the request.

    2.  The policy sends the prompt to Bedrock’s `ApplyGuardrail` API.

    3.  If the prompt violates any guardrail policies, the policy blocks the request and returns a
        `403` error code to the client.

    4.  If the prompt passes, the policy forwards the original request to the upstream LLM.

2.  **Response Phase** (when `moderateResponse` is enabled):

    1.  The policy intercepts the LLM response.

    2.  The policy sends the response to Bedrock’s `ApplyGuardrail` API.

    3.  If the response violates any guardrail policies, the policy returns a `403` error code to
        the client.

    4.  If the response passes, the policy forwards the original response to the client.

        > [!NOTE] Streaming responses (`text/event-stream`) are skipped and pass through without
        > moderation.

### Contextual Grounding

Contextual grounding helps detect hallucinations by scoring LLM responses on two dimensions:

- **Grounding**: Is the response derived from the provided reference text?

- **Relevance**: Does the response actually answer the user’s question?

To enable contextual grounding:

1.  Enable the contextual grounding feature on your AWS Bedrock guardrail.

2.  Configure both **Grounding Source Selector** and **Grounding Query Selector** in the policy.

The selectors are DataWeave expressions that extract:

- **Grounding source**: The reference text the answer should be based on (often the first message in
  a RAG conversation)

- **Query**: The user’s actual question (often the last message)

Both must be configured together. Configuring only one causes the Bedrock API to return an `400`
error code.

Example Configuration

```yaml
advancedConfiguration:
  groundingSourceSelector: "#[payload.messages[0].content]"
  groundingQuerySelector: "#[payload.messages[-1].content]"
```

### Response Headers

Every moderated response includes observability headers:

<table><colgroup><col> <col> <col></colgroup><thead><tr><th>Header</th><th>Values</th><th>Description</th></tr></thead><tbody><tr><td><div><div><p><code>x-llm-proxy-bedrock-guardrail-action</code></p></div></div></td><td><div><div><p><code>allow</code>, <code>reject</code></p></div></div></td><td><div><div><p>Final moderation decision. <code>reject</code> indicates content violated one or more policies.</p></div></div></td></tr><tr><td><div><div><p><code>x-llm-proxy-bedrock-guardrail-phase</code></p></div></div></td><td><div><div><p><code>request</code>, <code>response</code></p></div></div></td><td><div><div><p>Which phase performed the moderation. Useful for understanding whether the prompt or response was blocked.</p></div></div></td></tr><tr><td><div><div><p><code>x-llm-proxy-bedrock-guardrail-reason</code></p></div></div></td><td><div><div><p><code>content_filter</code>, <code>denied_topic</code>, <code>word_filter</code>, <code>pii</code>, <code>grounding</code>, <code>service_unavailable</code></p></div></div></td><td><div><div><p>Why the content was rejected. Multiple reasons are comma-separated if the content violated multiple policies.</p></div></div></td></tr></tbody></table>

## Example Configurations

### Minimal Configuration — Request and Response Moderation

```yaml
- policyRef:
    name: bedrock-guardrails-policy-v1-0-impl
  config:
    bedrockEndpoint: https://bedrock-runtime.us-east-1.amazonaws.com
    awsCredentials:
      accessKeyId: "${AWS_ACCESS_KEY_ID}"
      secretAccessKey: "${AWS_SECRET_ACCESS_KEY}"
      region: us-east-1
    guardrailIdentifier: "${GUARDRAIL_IDENTIFIER}"
    guardrailVersion: "1"
    moderateRequest: true
    moderateResponse: true
```

### Request-Only Moderation (Block Harmful Prompts)

```yaml
- policyRef:
    name: bedrock-guardrails-policy-v1-0-impl
  config:
    bedrockEndpoint: https://bedrock-runtime.us-east-1.amazonaws.com
    awsCredentials:
      accessKeyId: "${AWS_ACCESS_KEY_ID}"
      secretAccessKey: "${AWS_SECRET_ACCESS_KEY}"
      region: us-east-1
    guardrailIdentifier: paccgfhgnj1dc
    guardrailVersion: "1"
    moderateRequest: true
    moderateResponse: false
```

### With Contextual Grounding (Hallucination Detection)

```yaml
- policyRef:
    name: bedrock-guardrails-policy-v1-0-impl
  config:
    bedrockEndpoint: https://bedrock-runtime.us-east-1.amazonaws.com
    awsCredentials:
      accessKeyId: "${AWS_ACCESS_KEY_ID}"
      secretAccessKey: "${AWS_SECRET_ACCESS_KEY}"
      sessionToken: "${AWS_SESSION_TOKEN}" # for temporary credentials
      region: us-east-1
    guardrailIdentifier: paccgfhgnj1dc
    guardrailVersion: DRAFT
    moderateRequest: false
    moderateResponse: true
    advancedConfiguration:
      groundingSourceSelector: "#[payload.messages[0].content]"
      groundingQuerySelector: "#[payload.messages[-1].content]"
      apiTimeoutMs: 8000
      failOpen: false
```

### Fail-Open Configuration (High Availability)

```yaml
- policyRef:
    name: bedrock-guardrails-policy-v1-0-impl
  config:
    bedrockEndpoint: https://bedrock-runtime.us-east-1.amazonaws.com
    awsCredentials:
      accessKeyId: "${AWS_ACCESS_KEY_ID}"
      secretAccessKey: "${AWS_SECRET_ACCESS_KEY}"
      region: us-east-1
    guardrailIdentifier: paccgfhgnj1dc
    guardrailVersion: "1"
    moderateRequest: true
    moderateResponse: true
    advancedConfiguration:
      failOpen: true # Allow traffic if Bedrock is unavailable
      apiTimeoutMs: 3000
```

## See Also

- [Amazon Bedrock Guardrails](https://aws.amazon.com/bedrock/guardrails/) - AWS documentation

- [ApplyGuardrail API Reference](https://docs.aws.amazon.com/bedrock/latest/APIReference/API_runtime_ApplyGuardrail.html) -
  AWS API documentation

- [Creating and Managing Model Proxies](https://docs.mulesoft.com/general/model-proxy) - Overview of Model Proxy and
  routing

- [Applying Model Proxy Policies](https://docs.mulesoft.com/general/model-proxy-policies) - Other LLM policies