AI Defense Stack

LLM firewalls & guardrails

Amazon Bedrock Guardrails: managed AWS guardrail service for generative AI

Bedrock Guardrails is a managed AWS guardrail service for generative AI from Amazon Web Services. It is a commercial product offered as: API, Cloud-native, Managed service. Pricing model: usage-based.

  • Last reviewed
Visit Bedrock Guardrails (opens in a new tab) Documentation (opens in a new tab)
Commercial Layer 6: Runtime guardrails

Best for

Teams that already build on AWS and want managed filters they can apply to Bedrock models or to other models through an API call

Consider instead if

  • You want an open-source toolkit you can modify and run outside a cloud provider. See NeMo Guardrails.
  • You build on Azure and want a comparable managed service. See Azure AI Content Safety.

What Bedrock Guardrails does

Amazon Bedrock Guardrails is a managed AWS service that applies configurable safeguards to prompts and model responses. The documentation lists content filters (hate, insults, sexual, violence, misconduct and prompt attacks), denied topics, word filters, sensitive information filters for PII and custom regex, contextual grounding checks and Automated Reasoning checks. You can attach a guardrail to a Bedrock model call, or call the ApplyGuardrail API on its own with models hosted elsewhere. It is a closed-source cloud service billed per 1,000 text units, with word filters free. The AWS page names no compliance certifications for the feature itself, so check AWS for current attestations.

This summary is our own wording of the sourced facts on this page.

Key facts

Each value links to the page that states it, with the date we checked it.

Vendor
Amazon Web Services Source, checked October 21, 2026: aws.amazon.com (opens in a new tab)
Status
Active Source, checked October 21, 2026: docs.aws.amazon.com (opens in a new tab)
Open source
No: closed source (proprietary) Source, checked October 21, 2026: aws.amazon.com (opens in a new tab)
Latest release
Not documented in the sources we checked
Deployment
API, Cloud-native, Managed service Source, checked October 21, 2026: docs.aws.amazon.com (opens in a new tab)
Pricing model
Usage-based: Per 1,000 text units: content filters and denied topics $0.15; sensitive information filters and contextual grounding checks $0.10; Automated Reasoning checks $0.17 per policy; word filters free. (as listed on October 21, 2026; check the vendor for current pricing) Source, checked October 21, 2026: aws.amazon.com (opens in a new tab)
Website
aws.amazon.com Source, checked October 21, 2026: aws.amazon.com (opens in a new tab)
Documentation
docs.aws.amazon.com Source, checked October 21, 2026: docs.aws.amazon.com (opens in a new tab)
API reference
docs.aws.amazon.com Source, checked October 21, 2026: docs.aws.amazon.com (opens in a new tab)
Quickstart
Not documented in the sources we checked
Security page
Not documented in the sources we checked
Attestations or disclosure
Not documented in the sources we checked

Capabilities

As documented by the vendor or project. The tag is our label from a controlled vocabulary.

Integrations

Where Bedrock Guardrails fits in our AI security layers

Our analysis

Our editorial model, not a standard. The primary layer follows the category, except for tools whose main documented job is detection and response; other layers rest on a capability the sources document. How the model works.

AI security layers that Bedrock Guardrails covers, with the role, how each applies and what it rests on
LayerRoleHow it appliesBased on
L6 Runtime Runtime guardrails Primary Screen what goes into and comes out of a model in live traffic, and limit abuse of the model endpoint. Follows its category, LLM firewalls & guardrails
L5 Data Data protection Also covers Documents masking of personal data in prompts and responses. Blocks or masks PII and custom regex patterns in inputs and responses

OWASP LLM Top 10 mapping

Our analysis

The risk list is OWASP's (Top 10 for LLM Applications, 2025). The mapping is our analysis, and each row rests on a capability the sources document.

OWASP LLM risks mapped to Bedrock Guardrails, with the capabilities each mapping rests on
RiskHow it appliesBased on
LLM01 Prompt Injection The prompt attack content filter targets prompt injections and jailbreaks. Helps protect against prompt injection through the prompt attack content filter; Helps protect against jailbreaks through the prompt attack content filter
LLM02 Sensitive Information Disclosure Sensitive information filters block or mask PII in inputs and responses. Blocks or masks PII and custom regex patterns in inputs and responses
LLM05 Improper Output Handling Automated Reasoning checks validate model responses against logical rules. Validates model responses against logical rules with Automated Reasoning checks
LLM09 Misinformation Contextual grounding checks flag responses not grounded in the source. Detects hallucinations by checking responses against a source and the user query in RAG applications

Not mapped in our analysis: LLM07, LLM10. These are risks we expect tools in this category to cover; the sources we checked do not document a matching capability.

Alternatives and related tools

More in LLM firewalls & guardrails, ranked within the category by Coverage Score.

NVIDIA NeMo Guardrails

NVIDIA

Open sourceApache-2.0
  • Library
  • Self-hosted
  • API

Adds programmable input, dialog, retrieval, execution and output rails to LLM applications.

Best for: Teams that want to script rules for one LLM application in Python and run them in their own infrastructure

Coverage Score 76 out of 100
  • LLM01 Prompt Injection
  • LLM02 Sensitive Information Disclosure
  • LLM05 Improper Output Handling
  • LLM06 Excessive Agency

Reviewed

Portkey AI Gateway

Palo Alto Networks (Portkey)

Open sourceMIT Freemium Now Prisma AIRS AI Gateway
  • SaaS
  • Self-hosted
  • API

Routes LLM traffic through one gateway API and runs input and output guardrail checks on each request.

Best for: Teams that want a single gateway for several LLM providers with guardrail checks, available as open source or as a hosted service

Coverage Score 69 out of 100
  • LLM01 Prompt Injection
  • LLM02 Sensitive Information Disclosure
  • LLM05 Improper Output Handling
  • LLM09 Misinformation

Reviewed

Kong AI Gateway

Kong

Open sourceApache-2.0
  • Self-hosted
  • SaaS
  • API

Routes LLM traffic through Kong with prompt guards, PII sanitization, spend limits and observability.

Best for: Teams that already run Kong as an API gateway and want LLM routing and prompt controls on the same data plane

Coverage Score 65 out of 100
  • LLM01 Prompt Injection
  • LLM02 Sensitive Information Disclosure
  • LLM10 Unbounded Consumption

Reviewed

Head-to-head comparisons

Bedrock Guardrails FAQ

Is Amazon Bedrock Guardrails open source?

No. It is a managed AWS service, and the AWS pages link no source repository for it.

Can it be used with models outside Amazon Bedrock?

Yes. The user guide says guardrails can be used directly through the ApplyGuardrail API without invoking a foundation model.

How is Amazon Bedrock Guardrails priced?

AWS bills per 1,000 text units by safeguard type, and lists word filters as free. See the Amazon Bedrock pricing page for the rates in effect.

Key facts you can cite

We have no commercial relationship with Amazon Web Services.

Sources & last reviewed

Last reviewed . We compile from the vendors' own public pages and repositories and we do not run the products. Source links open in a new tab. Found a mistake? Report a correction.