Info icon
End of Life Notice: For Trend Cloud One™ - Conformity Customers, Conformity will reach its End of Sale on “July 31st, 2025” and End of Life “July 31st, 2026”. The same capabilities and much more is available in TrendAI Vision One™ Cloud Risk Management. For details, please refer to Upgrade to TrendAI Vision One™
Logo of TrendAI

Configure Topic Deny Policies for Bedrock Guardrails

TrendAI Vision One™ provides continuous assurance that gives peace of mind for your cloud infrastructure, delivering over 1400 automated best practice checks.

Risk Level: Medium (should be achieved)

Ensure that your Amazon Bedrock guardrails have at least one topic policy configured with a denied topic (a topic policy of type DENY) to restrict the scope of conversations handled by your generative AI application. Denied topics allow you to explicitly define subjects that are undesirable in the context of your application, and instruct the guardrail to block prompts and responses that fall within those topics.

Security

Topic policies in Amazon Bedrock guardrails evaluate model prompts and responses against a set of denied topics that you define, such as investment advice, competitor information, internal processes, or attack methodologies. If a denied topic is detected, the guardrail blocks the prompt or response before it reaches the end user or the foundation model. Without at least one denied topic configured, a guardrail has no mechanism to restrict the scope of conversations to the intended domain of your application, allowing the model to engage with off-topic, sensitive, or potentially harmful subjects. An identity with the bedrock:UpdateGuardrail permission can remove topic restrictions from a guardrail to reduce its filtering scope, allowing the underlying model to discuss sensitive topics such as competitor data, internal processes, or attack methodologies that should otherwise be blocked.

Audit

To determine if your Amazon Bedrock guardrails have at least one topic policy with denied topics configured, perform the following operations:

Using AWS Console

  1. Sign in to the AWS Management Console.

  2. Navigate to Amazon Bedrock console available at https://console.aws.amazon.com/bedrock/.

  3. In the main navigation panel, under Build, select Guardrails.

  4. In the Guardrails section, click on the name (link) of the Amazon Bedrock guardrail that you want to examine, available in the Name column.

  5. In the Working draft section, click on Working draft (link) to open the current draft defined for the selected guardrail.

  6. In the Denied topics section, check whether any denied topics are listed:

    1. If the Denied topics section is empty (no topics listed), the selected Amazon Bedrock guardrail does not have a topic policy configured to restrict the scope of conversations.
    2. If one or more denied topics are listed, the selected Amazon Bedrock guardrail is configured with a topic deny policy.

  7. Repeat steps no. 4 - 6 for each Amazon Bedrock guardrail available within the current AWS region.

  8. Change the AWS cloud region from the navigation bar to repeat the Audit process for other regions.

Using AWS CLI

  1. Run list-guardrails command (OSX/Linux/UNIX) to list the Amazon Resource Name (ARN) of each Amazon Bedrock guardrail available in the selected AWS cloud region:

    aws bedrock list-guardrails
  --region us-east-1
  --query 'guardrails[*].arn'

  2. The command output should return the requested guardrail identifiers (ARNs):

    [
    "arn:aws:bedrock:us-east-1:123456789012:guardrail/abcd1234abcd",
    "arn:aws:bedrock:us-east-1:123456789012:guardrail/1234abcd1234"
]

  3. Run get-guardrail command (OSX/Linux/UNIX) with the identifier (ID or ARN) of the Amazon Bedrock guardrail that you want to examine, to describe the topics configured with a DENY policy type for the selected guardrail:

    aws bedrock get-guardrail
  --region us-east-1
  --guardrail-identifier arn:aws:bedrock:us-east-1:123456789012:guardrail/abcd1234abcd
  --query 'topicPolicy.topics[?type==`DENY`].name'

  4. The command output should return the names of the topics configured with a DENY policy type for your guardrail:

    [
    "Competitor Information",
    "Attack Methodologies"
]

    If the get-guardrail command output returns null (the guardrail has no topic policy configured at all) or an empty list [ ] (the guardrail has a topic policy but no topics of type DENY), the selected Amazon Bedrock guardrail does not have any denied topics configured and is not restricting the scope of conversations handled by the underlying model.

  5. Repeat steps no. 3 and 4 for each Amazon Bedrock guardrail available in the selected AWS region.

  6. Change the AWS cloud region by updating the --region command parameter value and repeat steps no. 1 – 5 to perform the Audit process for other regions.

Remediation / Resolution

To ensure that your Amazon Bedrock guardrails have at least one topic policy with denied topics configured, perform the following operations:

Using AWS Console

  1. Sign in to the AWS Management Console.

  2. Navigate to Amazon Bedrock console available at https://console.aws.amazon.com/bedrock/.

  3. In the main navigation panel, under Build, select Guardrails.

  4. In the Guardrails section, click on the name (link) of the Amazon Bedrock guardrail that you want to configure, available in the Name column.

  5. In the Working draft section, click on Working draft (link) to open the current draft defined for the selected guardrail.

  6. Choose Edit from the Denied topics section to configure the topic policy for the selected guardrail.

  7. Choose Add denied topic, then provide the following configuration:

    1. Enter a Name for the topic (a noun or short phrase, not a description).
    2. Enter a Definition (up to 200 characters) that summarizes the content of the topic and its subtopics.
    3. (Optional) Expand Add sample phrases and provide up to five example prompts or responses that belong to the topic.
    4. Confirm that Input and Output evaluation are enabled, with the Block action selected, so that the guardrail blocks matching prompts and responses.

  8. Choose Confirm to save the denied topic, and repeat as needed to add further denied topics.

  9. Choose Save and exit to apply the configuration changes.

  10. Repeat steps no. 4 - 9 for each Amazon Bedrock guardrail that you want to configure, available within the current AWS region.

  11. Change the AWS cloud region from the navigation bar and repeat the Remediation process for other regions.

Using AWS CLI

  1. Run update-guardrail command (OSX/Linux/UNIX) with the identifier (ID or ARN) of the Amazon Bedrock guardrail that you want to configure, to add at least one denied topic to the selected guardrail. The --topic-policy-config parameter must be specified in full, including any topics you want to keep unchanged, since update-guardrail replaces the entire topic policy configuration rather than patching individual topics. Important: update-guardrail performs a full replacement of the guardrail configuration (an HTTP PUT), not a partial update. Any other policy configuration currently on the guardrail (content, word, sensitive information, contextual grounding, or automated reasoning policies) that you do not re-supply in this command will be removed. Before running the command, use get-guardrail to retrieve the guardrail's current configuration, then re-supply every policy you want to keep alongside the new denied topics:

    aws bedrock update-guardrail
  --region us-east-1
  --guardrail-identifier arn:aws:bedrock:us-east-1:123456789012:guardrail/abcd1234abcd
  --name tm-project5-ai-guardrail
  --blocked-input-messaging "Sorry, the model cannot answer this question."
  --blocked-outputs-messaging "Sorry, the model cannot answer this question."
  --topic-policy-config 'topicsConfig=[{name="Competitor Information",definition="Questions or statements seeking information about competitor products, pricing, or strategy.",type="DENY"},{name="Attack Methodologies",definition="Requests for guidance on exploiting, attacking, or bypassing security controls.",type="DENY"}]'

  2. The command output should return the identification details available for the configured guardrail:

    {
    "guardrailId": "abcd1234abcd",
    "guardrailArn": "arn:aws:bedrock:us-east-1:123456789012:guardrail/abcd1234abcd",
    "version": "DRAFT",
    "updatedAt": "2024-06-15T10:07:34.347840+00:00"
}

  3. Repeat steps no. 1 and 2 for each Amazon Bedrock guardrail that you want to configure, available in the selected AWS region.

  4. Change the AWS cloud region by updating the --region command parameter value and repeat the Remediation process for other regions.

References

Publication date Jul 13, 2026

Related Bedrock rules