AWS bedrock documentation change
Summary
Expanded deployment documentation with detailed steps for creating immutable policy versions, attaching to guardrails, exporting policies for CI/CD, and CloudFormation automation. Added API examples, cross-region configuration requirements, and KMS encryption guidance.
Security assessment
The changes focus on deployment workflow improvements and automation processes. While they mention security best practices like immutability and KMS encryption, there's no evidence of addressing a specific vulnerability or security incident. The KMS guidance references existing documentation without introducing new security features.
Diff
diff --git a/bedrock/latest/userguide/deploy-automated-reasoning-policy.md b/bedrock/latest/userguide/deploy-automated-reasoning-policy.md index c6819298b..4d01839d7 100644 --- a//bedrock/latest/userguide/deploy-automated-reasoning-policy.md +++ b//bedrock/latest/userguide/deploy-automated-reasoning-policy.md @@ -5 +5 @@ -Save a version of your Automated Reasoning policyAdd your Automated Reasoning policy to your guardrail +Save a version of your Automated Reasoning policyAdd your Automated Reasoning policy to your guardrailExport a policy version for deploymentAutomate deployment with CloudFormationNext steps @@ -9 +9 @@ Save a version of your Automated Reasoning policyAdd your Automated Reasoning po -After you've tested your Automated Reasoning policy and are satisfied with its performance, you can deploy it for use in your application with Amazon Bedrock Guardrails. +After you've tested your Automated Reasoning policy and are satisfied with its performance, you can deploy it for use in your application with Amazon Bedrock Guardrails. This page covers the full deployment workflow: saving an immutable version, attaching it to a guardrail, automating deployment with CloudFormation, and integrating into CI/CD pipelines. @@ -13 +13 @@ After you've tested your Automated Reasoning policy and are satisfied with its p -When you're done testing your policy, you can create an immutable copy of the policy to use with your application. +When you're done testing your policy, create an immutable version. Immutable versions ensure that the policy attached to your guardrail doesn't change unexpectedly when you continue editing the DRAFT. Each version is identified by a numeric version number (1, 2, 3, ...) and cannot be modified after creation. @@ -19 +19 @@ When you're done testing your policy, you can create an immutable copy of the po - 2. Choose the **Automated Reasoning** policy that you want to use with your application. + 2. Choose the Automated Reasoning policy that you want to use with your application. @@ -28 +28 @@ When you're done testing your policy, you can create an immutable copy of the po -You can use the `CreateAutomatedReasoningPolicyVersion` API operation to create an immutable version of your Automated Reasoning policy. +Use the `CreateAutomatedReasoningPolicyVersion` API to create an immutable version of your Automated Reasoning policy. @@ -32,2 +31,0 @@ You can use the `CreateAutomatedReasoningPolicyVersion` API operation to create -The following parameters are required when creating a policy version: - @@ -42 +40 @@ The Amazon Resource Name (ARN) of the Automated Reasoning policy for which to cr -The hash of the policy definition for the new version. You can retreive this hash from the `GetAutomatedReasoningPolicy` API action. +The hash of the policy definition for the new version. Retrieve this hash from the `GetAutomatedReasoningPolicy` API. This ensures you're versioning the exact policy definition you tested. @@ -46 +43,0 @@ The hash of the policy definition for the new version. You can retreive this has -The following example shows how to create a version of an Automated Reasoning policy using the AWS CLI: @@ -47,0 +45,4 @@ The following example shows how to create a version of an Automated Reasoning po + # Get the current definition hash + aws bedrock get-automated-reasoning-policy \ + --policy-arn "arn:aws:bedrock:us-east-1:111122223333:automated-reasoning-policy/lnq5hhz70wgk" \ + --query "definitionHash" --output text @@ -48,0 +50 @@ The following example shows how to create a version of an Automated Reasoning po + # Create the version @@ -51 +53 @@ The following example shows how to create a version of an Automated Reasoning po - --last-updated-definition-hash "583463f067a8a4f49fc1206b4642fd40b1c877a0141109ad0a3cf213f87df0ad21455e049dbe43dda94253439d9d3710f9ae161b4842d825d7bda119ffb92a5d" + --last-updated-definition-hash "583463f067a8a4f49fc1206b4642fd40..." @@ -64 +66 @@ Example response: -Once you have a saved version of your Automated Reasoning policy, you can add the policy to your guardrail. +Once you have a saved version of your Automated Reasoning policy, add it to a guardrail. The guardrail is the runtime component that your application calls to validate LLM responses. You can add an Automated Reasoning policy to a new or existing guardrail. @@ -68 +70 @@ Once you have a saved version of your Automated Reasoning policy, you can add th - 1. In the left navigation, choose **Guardrails** , then choose **Create guardrail**. + 1. In the left navigation, choose **Guardrails** , then choose **Create guardrail** (or select an existing guardrail and choose **Edit**). @@ -74 +76 @@ Once you have a saved version of your Automated Reasoning policy, you can add th - 4. Finish creating your guardrail. + 4. Finish creating or updating your guardrail. @@ -81 +83 @@ Once you have a saved version of your Automated Reasoning policy, you can add th -You can use the `CreateGuardrail` or `UpdateGuardrail` API operations to add an Automated Reasoning policy to your guardrail. +Use the `CreateGuardrail` or `UpdateGuardrail` API to add an Automated Reasoning policy to your guardrail. Include the `automatedReasoningConfig` parameter with the versioned policy ARN. @@ -85,2 +86,0 @@ You can use the `CreateGuardrail` or `UpdateGuardrail` API operations to add an -When creating or updating a Amazon Bedrock Guardrails, include the following parameter to enable Automated Reasoning checks in Amazon Bedrock Guardrails: - @@ -95 +95 @@ The configuration for Automated Reasoning checks in Amazon Bedrock Guardrails. -The Amazon Resource Name (ARN) of the Automated Reasoning policy version to use with your guardrail. +The ARN of the Automated Reasoning policy version to use with your guardrail. Use the versioned ARN (ending in `:1`, `:2`, etc.), not the unversioned ARN. @@ -99,2 +98,0 @@ The Amazon Resource Name (ARN) of the Automated Reasoning policy version to use -The following example shows how to create a guardrail with an Automated Reasoning policy using the AWS CLI: - @@ -105,4 +103,180 @@ The following example shows how to create a guardrail with an Automated Reasonin - --automated-reasoning-config policyArn="arn:aws:bedrock:us-west-2:123456789012:automated-reasoning-policy/t3x7y9z2a5b8:1" \ - --topic-policy-config blockedTopics=[] \ - --content-policy-config filters=[] \ - --sensitive-information-policy-config piiEntities=[] + --automated-reasoning-policy-config policies="arn:aws:bedrock:us-east-1:111122223333:automated-reasoning-policy/lnq5hhz70wgk:1" \ + --cross-region-config '{"guardrailProfileIdentifier": "us.guardrail.v1:0"}' \ + --blocked-input-messaging "I cannot process this request." \ + --blocked-outputs-messaging "I cannot provide this response." + +###### Important + +Use the versioned policy ARN (for example, `arn:aws:bedrock:us-east-1:111122223333:automated-reasoning-policy/lnq5hhz70wgk:1`). If you use the unversioned ARN, the API returns an error. Create a version first using `CreateAutomatedReasoningPolicyVersion`. + +###### Important + +Guardrails that use Automated Reasoning checks require a cross-Region inference profile. Include the `--cross-region-config` parameter with a `guardrailProfileIdentifier` that matches your Region prefix (for example, `us.guardrail.v1:0` for US Regions or `eu.guardrail.v1:0` for EU Regions). If you omit this parameter, the API returns a `ValidationException`. + +## Export a policy version for deployment + +To deploy a policy through CloudFormation or a CI/CD pipeline, you need the policy definition JSON. Use the `ExportAutomatedReasoningPolicyVersion` API to export the complete policy definition — including all rules, variables, and custom types — from a saved version. + +The exported definition is the same format accepted by the CloudFormation `AWS::Bedrock::AutomatedReasoningPolicy` resource's `PolicyDefinition` property. This makes it straightforward to move a policy from the interactive console workflow to automated deployment. + + + # Export the policy definition from version 1 + aws bedrock export-automated-reasoning-policy-version \ + --policy-arn "arn:aws:bedrock:us-east-1:111122223333:automated-reasoning-policy/lnq5hhz70wgk:1" \ + --query "policyDefinition" \ + --output json > policy-definition.json + +The exported JSON contains the following structure: + + + { + "version": "1.0", + "variables": [ + { + "name": "isFullTime", + "type": "BOOL", + "description": "Whether the employee works full-time (true) or part-time (false)." + }, + { + "name": "tenureMonths", + "type": "INT", + "description": "The number of complete months the employee has been continuously employed." + } + ], + "rules": [ + { + "id": "A1B2C3D4E5F6", + "expression": "(=> (and isFullTime (> tenureMonths 12)) eligibleForParentalLeave)" + } + ], + "types": [] + } + +Store this file in version control alongside your CloudFormation templates. When you update your policy, export the new version and update the file to trigger a deployment. + +## Automate deployment with CloudFormation + +Use CloudFormation to deploy your Automated Reasoning policy and guardrail as infrastructure as code. The `AWS::Bedrock::AutomatedReasoningPolicy` resource creates a policy with a policy definition that you export from the API or console. Combined with `AWS::Bedrock::Guardrail`, you can deploy the complete validation stack in a single template. + +###### Note + +CloudFormation creates the policy resource with the policy definition you provide. It does not run a build workflow or extract rules from source documents. You must first create and test your policy interactively (using the console, API, or Kiro CLI), then export the tested policy definition for use in your template. For more information, see Export a policy version for deployment. + +For the complete property reference of the policy resource, see [AWS::Bedrock::AutomatedReasoningPolicy](https://docs.aws.amazon.com/AWSCloudFormation/latest/TemplateReference/aws-resource-bedrock-automatedreasoningpolicy.html) in the _CloudFormation Template Reference_. + +### Example: Deploy a policy and guardrail + +The following CloudFormation template creates an Automated Reasoning policy with a policy definition and a guardrail that references it. Replace the policy definition with the JSON exported from your tested policy. + + + AWSTemplateFormatVersion: '2010-09-09' + Description: Deploy an Automated Reasoning policy and guardrail + + Parameters: + PolicyName: + Type: String + Default: MyHRPolicy + Description: Name of the Automated Reasoning policy + GuardrailName: + Type: String + Default: HR-Policy-Guardrail + Description: Name of the guardrail + + Resources: + AutomatedReasoningPolicy: + Type: AWS::Bedrock::AutomatedReasoningPolicy + Properties: + Name: !Ref PolicyName + Description: Validates HR chatbot responses about leave eligibility + PolicyDefinition: + Version: '1.0' + Variables: + - Name: isFullTime + Type: BOOL + Description: >- + Whether the employee works full-time (true) or part-time (false). + Set to true when users mention being full-time or working 40+ hours + per week. + - Name: tenureMonths + Type: INT + Description: >- + The number of complete months the employee has been continuously + employed. When users mention years of service, convert to months + (for example, 2 years = 24 months). + - Name: eligibleForParentalLeave + Type: BOOL + Description: >- + Whether the employee is eligible for parental leave based on + employment status and tenure. + Rules: + - Id: A1B2C3D4E5F6 + Expression: >- + (=> (and isFullTime (> tenureMonths 12)) + eligibleForParentalLeave) + - Id: G7H8I9J0K1L2 + Expression: >- + (=> (or (not isFullTime) (<= tenureMonths 12)) + (not eligibleForParentalLeave)) + Types: [] + Tags: + - Key: Environment + Value: Production + - Key: Team + Value: HR + + Guardrail: + Type: AWS::Bedrock::Guardrail + Properties: + Name: !Ref GuardrailName + Description: Guardrail with Automated Reasoning checks for HR policy + BlockedInputMessaging: I cannot process this request. + BlockedOutputsMessaging: I cannot provide this response. + AutomatedReasoningPolicyConfig: + Policies: + - !GetAtt AutomatedReasoningPolicy.PolicyArn + CrossRegionConfig: + GuardrailProfileArn: !Sub "arn:aws:bedrock:${AWS::Region}:${AWS::AccountId}:guardrail-profile/us.guardrail.v1:0" +