AWS Security Blog
Route Amazon Bedrock Guardrails interventions to Amazon Security Lake
Security teams investigating AI-related incidents need guardrail intervention data alongside their existing security telemetry. Routing Amazon Bedrock Guardrails violations to Amazon Security Lake makes this possible. With this integration, you can query guardrail events alongside identity, network, and application security data in a single layer. When a guardrail blocks a prompt injection attempt or redacts sensitive data, that intervention carries investigative value comparable to a failed sign-in or a network intrusion alert. Amazon Bedrock publishes this telemetry to Amazon CloudWatch metrics and model invocation logs for operational monitoring. By using Security Lake, organizations can extend this telemetry into their security data lake for unified correlation.
In this post, I show you how to build an automated pipeline that transforms Amazon Bedrock Guardrails intervention events into Open Cybersecurity Schema Framework (OCSF) records and delivers them to Security Lake as a custom source. You can query the data using Amazon Athena or any Security Lake subscriber.
Use case
Consider a financial services organization deploying Amazon Bedrock across multiple business units. Each unit uses guardrails to enforce content policies (blocking harmful content), topic policies (preventing off-topic queries about competitors), sensitive information policies (redacting personally identifiable information (PII) such as account numbers), and prompt injection detection.
The security team needs to:
- Identify which user accounts trigger the most guardrail interventions and whether those accounts also have unusual AWS Identity and Access Management (IAM) activity
- Determine if prompt injection attempts correlate with specific source IP addresses that also appear in Amazon Virtual Private Cloud (Amazon VPC) Flow Logs
- Track the organization-wide trend of guardrail violations across all business units and compare it against the baseline from 30 days ago
With guardrail events routed to Security Lake, a single Athena query covers all three.
Solution overview
The pipeline architecture routes Amazon Bedrock security events to Security Lake as OCSF-compliant records. The same infrastructure—subscription filter, AWS Lambda transformation, Parquet writer, Amazon Simple Storage Service (Amazon S3) partitioning—supports multiple event types by changing the filter pattern and OCSF mapping:
| Guardrail interventions (this post) | DETECTION_FINDING | 2004 |
| Model invocation API calls | API_ACTIVITY | 6003 |
| Agent guardrail traces | DETECTION_FINDING | 2004 |
| Token consumption anomalies | DETECTION_FINDING | 2004 |
This post demonstrates the guardrail interventions implementation as a working example. The solution captures Amazon Bedrock model invocation logs that contain guardrail trace data and filters for intervention events. It transforms matching events into OCSF-compliant Detection Finding records (class_uid 2004) and delivers them to Security Lake as Parquet files. Guardrail interventions are detection events: the guardrail detected and blocked prohibited content, so OCSF class 2004 (Detection Finding) under the Findings category is the appropriate classification.
Architecture
The following diagram shows the end-to-end pipeline from guardrail intervention to Security Lake ingestion.
The data flow consists of the following steps:
- An application calls Amazon Bedrock (InvokeModel or Converse API) with a guardrail attached.
- Amazon Bedrock evaluates the guardrail and logs the invocation (including guardrail trace data) to a CloudWatch Logs log group using model invocation logging. The subscription filter matches log entries where the guardrail action is
INTERVENED
(blocked or masked content). - The subscription filter delivers matching records to a Lambda function (OCSF Transform).
- The Lambda function transforms each intervention event into an OCSF Detection Finding record (class_uid 2004), batches records, and converts them to Zstandard (zstd)-compressed Apache Parquet format. It writes the Parquet file to the Amazon S3 Security Lake bucket using the required partition path (
ext/BedrockGuardrails/region=/accountId=/eventDay=/
). If the Lambda function fails to process a record, the message routes to an Amazon Simple Queue Service (Amazon SQS) dead-letter queue for later analysis and redrive. - Security Lake manages the ingested Parquet data in the S3 bucket.
- AWS Glue crawler detects new partitions and catalogs the Parquet files for query access.
- SOC analysts query guardrail violation data alongside other security sources using Athena.
OCSF mapping
The following table shows how Amazon Bedrock Guardrails intervention fields map to OCSF Detection Finding (class_uid 2004) attributes.
| OCSF field | Source | Example value |
class_uid |
Static | 2004 (Detection Finding) |
category_uid |
Static | 2 (Findings) |
severity_id |
Derived from policy type | 3 (Medium) for content/topic; 4 (High) for prompt injection |
activity_id |
Static | 1 (Create) |
time |
Invocation log timestamp |
1721001600000 |
cloud.provider |
Static | AWS |
cloud.region |
Invocation log region |
us-east-1 |
cloud.account.uid |
Invocation log accountId |
123456789012 |
actor.user.uid |
Invocation log identity.arn |
arn:aws:sts::123456789012:assumed-role/AppRole/session |
finding_info.title |
Derived from policy type | ContentPolicy Intervention |
finding_info.desc |
Guardrail trace action/topic | Blocked: HATE content detected on INPUT |
resource.uid |
Model ARN | arn:aws:bedrock:us-east-1::foundation-model/anthropic.claude-sonnet-4-6-20250514-v1:0 |
resource.type |
Static | AwsBedrock:Model |
metadata.product.name |
Static | Amazon Bedrock Guardrails |
metadata.product.vendor_name |
Static | AWS |
metadata.version |
Static | 1.3.0 |
unmapped.guardrail_id |
Guardrail trace guardrailId |
my-content-guardrail |
unmapped.guardrail_arn |
Guardrail trace guardrailArn |
arn:aws:bedrock:us-east-1:123456789012:guardrail/abc123 |
unmapped.guardrail_version |
Guardrail trace guardrailVersion |
3 |
unmapped.guardrail_content_source |
Guardrail trace | INPUT or OUTPUT |
unmapped.guardrail_policy_type |
Guardrail trace | ContentPolicy , TopicPolicy , SensitiveInformationPolicy , WordPolicy , ContextualGroundingPolicy , PromptAttack |
Prerequisites
The following prerequisites are needed to deploy the reference implementation. Before you begin, clone the repository:
Verify you have the following:
- An AWS account with AWS Cloud Development Kit (AWS CDK) bootstrapped in the target AWS Region
- Security Lake enabled in the target Region
- Python 3.12 or later
- Node.js 20 or later (for AWS CDK CLI)
- An existing Amazon Bedrock guardrail (or create one during deployment)
- Model invocation logging enabled on Amazon Bedrock (with guardrail trace data enabled)
Implementation
The reference implementation deploys three CloudFormation stacks: SecurityLakeSourceStack
, TransformPipelineStack
and MonitoringStack
. The following commands deploy the stacks in dependency order:
Enable model invocation logging
Model invocation logging captures the guardrail trace data you need. Turn on full request and response logging to a CloudWatch Logs log group. Configure textDataDeliveryEnabled
to capture text request and response bodies, which include the guardrail trace output when a guardrail is attached to the invocation.
Register Security Lake custom source
Register BedrockGuardrails
as a custom source with Security Lake using the DETECTION_FINDING
event class. Security Lake creates the Amazon S3 prefix and IAM role for your source. The stack configures the AWS Glue crawler role for partition discovery.
Create the subscription filter
Create a CloudWatch Logs subscription filter on your model invocation log group with the filter pattern { $.output.guardrailAction = “INTERVENED” }
. This captures only the events where a guardrail blocked or modified content, not the successful pass-through events. This reduces Lambda invocations and cost.
Transform to OCSF and write Parquet
The Lambda function performs three operations: parse the CloudWatch Logs event, transform each intervention to an OCSF Detection Finding record (class_uid 2004), and write batched records as Parquet files. The files are written to the Security Lake S3 bucket using the required partition path (ext/BedrockGuardrails/region=/accountId=/eventDay=/
).
The transformation maps guardrail trace fields to OCSF attributes as described in the OCSF mapping table. Severity is set to High
for prompt injection interventions and Medium
for content, topic, or sensitive information interventions. For a concrete before-and-after example, see the sample invocation log and corresponding OCSF output in the companion repository.
Scaling considerations: At low intervention volumes (tens of events per hour), direct Lambda writes produce acceptably sized Parquet files. For higher volumes, consider buffering through Amazon Data Firehose with its native Parquet conversion and 5-minute buffering interval to produce fewer, larger files that optimize Athena query performance.
Multi-account deployment: The partition scheme (accountId
=
) already supports multi-account environments. Deploy the subscription filter and transform pipeline in each workload account where model invocation logging is enabled. Each pipeline writes cross-account to the delegated-administrator Security Lake bucket. Distribute the pipeline using CloudFormation StackSets across the organization.
Query violations in Athena
After deployment, guardrail violations typically appear in your Security Lake tables within 5–10 minutes, depending on the AWS Glue crawler schedule. You can then run cross-service correlation queries. The following example identifies users who trigger both prompt injection interventions and unusual IAM activity:
You can also track violation trends by policy type over time to establish baselines and detect spikes. The following query shows the 30-day trend:
The OCSF mapping has been validated against schema version 1.3.0, and the Security Lake AWS Glue crawler correctly detects the partitioned Parquet files for querying.
Alternative for teams not yet using Security Lake: If your organization hasn’t adopted Security Lake, you can query guardrail intervention events directly in CloudWatch Logs Insights using the same subscription filter log group. CloudWatch Logs Insights supports cross-log-group queries, so you can correlate guardrail events with other CloudWatch log sources without the OCSF transformation step. Security Lake adds value when you need to join with non-CloudWatch sources in a single query layer. Examples include Amazon VPC Flow Logs, Amazon Route 53 DNS logs, and third-party findings.
Clean up
To avoid ongoing charges, destroy the stacks in reverse dependency order:
Conclusion
In this post, you learned how to route Amazon Bedrock Guardrails intervention events to Amazon Security Lake as OCSF-compliant Detection Finding records. This integration extends guardrail telemetry from Amazon CloudWatch into your security data lake. Security analysts can then run cross-service correlation of AI intervention events with IAM, network, and application telemetry.
The pipeline filters for intervention events only, keeping costs low while capturing the security-relevant signals. The records use OCSF event class 2004 (Detection Finding), which integrates with supported Security Lake subscribers such as Amazon OpenSearch Service and third-party SIEM tools.
Clone the reference implementation and adapt the OCSF mapping and subscription filter to your organization’s guardrail configuration.
References
- Amazon Bedrock Guardrails
- Amazon Security Lake
- Collecting data from custom sources in Amazon Security Lake
- Monitor Amazon Bedrock Guardrails using CloudWatch metrics
- OCSF Detection Finding (class_uid 2004)
If you have feedback about this post, submit comments in the Comments section below.