Configure Prompt Attack Strength for Amazon Bedrock Guardrails

01 Sign in to the AWS Management Console.

02 Navigate to Amazon Bedrock console available at https://console.aws.amazon.com/bedrock/.

03 In the main navigation panel, under Safeguards, select Guardrails.

04 In the Guardrails section, click on the name (link) of the Amazon Bedrock guardrail that you want to examine, available in the Name column.

05 In the Working Draft section, click on Working Draft (link) to open the current draft defined for the selected guardrail.

06 In the Prompt attacks section, perform the following checks:

1. If the Prompt attacks filter status is set to Disabled, the selected Amazon Bedrock guardrail is not configured with a prompt attacks filter.
2. If the Prompt attacks filter status is set to Enabled, check the Filter strength attribute value to determine the prompt attack strength configured for your guardrail. If the Filter strength value is not High, the prompt attack strength for the selected Amazon Bedrock guardrail is not set to HIGH to protect against malicious inputs.

07 Repeat steps no. 4 - 6 for each Amazon Bedrock guardrail available within the current AWS region.

08 Change the AWS cloud region from the navigation bar to repeat the Audit process for other regions.

01 Run list-guardrails command (OSX/Linux/UNIX) to list the Amazon Resource Name (ARN) of each Amazon Bedrock guardrail available in the selected AWS cloud region:

aws bedrock list-guardrails
  --region us-east-1
  --query 'guardrails[*].arn'

02 The command output should return the requested guardrail identifiers (ARNs):

[
	"arn:aws:bedrock:us-east-1:123456789012:guardrail/abcd1234abcd",
	"arn:aws:bedrock:us-east-1:123456789012:guardrail/1234abcd1234"
]

03 Run get-guardrail command (OSX/Linux/UNIX) with the name of the Amazon Bedrock guardrail that you want to examine as the identifier parameter, to describe the prompt attack strength configured for the selected guardrail:

aws bedrock get-guardrail
  --region us-east-1
  --guardrail-identifier arn:aws:bedrock:us-east-1:123456789012:guardrail/abcd1234abcd
  --query 'contentPolicy.filters[?(type==`PROMPT_ATTACK`)].inputStrength'

04 The command output should return the prompt attack strength set for your guardrail:

[
	"LOW"
]

05 Repeat steps no. 3 and 4 for each Amazon Bedrock guardrail available in the selected AWS region.

06 Change the AWS cloud region by updating the --region command parameter value and repeat steps no. 1 – 5 to perform the Audit process for other regions.

01 Sign in to the AWS Management Console.

02 Navigate to Amazon Bedrock console available at https://console.aws.amazon.com/bedrock/.

03 In the main navigation panel, under Safeguards, select Guardrails.

04 In the Guardrails section, click on the name (link) of the Amazon Bedrock guardrail that you want to configure, available in the Name column.

05 In the Working Draft section, click on Working Draft (link) to open the current draft defined for the selected guardrail.

06 Choose Edit from the Prompt attacks section to edit the content filters configured for the selected guardrail.

07 In the Prompt attacks section, ensure that Enable prompt attacks filter is active, and set the Prompt Attack setting slider to High.

08 Choose Save and exit to apply the configuration changes.

09 Repeat steps no. 4 - 8 for each Amazon Bedrock guardrail that you want to configure, available within the current AWS region.

10 Change the AWS cloud region from the navigation bar and repeat the Remediation process for other regions.

01 Run update-guardrail command (OSX/Linux/UNIX) with the name of the Amazon Bedrock guardrail that you want to configure as the identifier parameter, to set the prompt attack strength to HIGH for the selected guardrail. Use the --content-policy-config command parameter to configure the prompt attack strength for your guardrail:

aws bedrock update-guardrail
  --region us-east-1
  --guardrail-identifier arn:aws:bedrock:us-east-1:123456789012:guardrail/abcd1234abcd
  --name tm-project5-ai-guardrail
  --blocked-input-messaging "Sorry, the model cannot answer this question."
  --blocked-outputs-messaging "Sorry, the model cannot answer this question."
  --content-policy-config 'filtersConfig=[{type="PROMPT_ATTACK",inputStrength="HIGH",outputStrength="NONE"},{type="SEXUAL",inputStrength="HIGH",outputStrength="HIGH"},
{type="HATE",inputStrength="HIGH",outputStrength="HIGH"},{type="VIOLENCE",inputStrength="HIGH",outputStrength="HIGH"},{type="INSULTS",inputStrength="HIGH",outputStrength="HIGH"},{type="MISCONDUCT",inputStrength="MEDIUM",outputStrength="MEDIUM"}]'

02 The command output should return the identification details available for the configured guardrail:

{
	"guardrailId": "abcd1234abcd",
	"guardrailArn": "arn:aws:bedrock:us-east-1:123456789012:guardrail/abcd1234abcd",
	"version": "DRAFT",
	"updatedAt": "2024-06-15T10:07:34.347840+00:00"
}

03 Repeat steps no. 1 and 2 for each Amazon Bedrock guardrail that you want to configure, available in the selected AWS region.

04 Change the AWS cloud region by updating the --region command parameter value and repeat the Remediation process for other regions.