Amazon BedrockAuthorCloudBrum editorial teamLast reviewed30 Oct 2026Reading time~12 minLevelBeginner to advanced

# Placeholders: replace the Region and the model. Use a model ID or inference profile ID that "aws bedrock list-foundation-models" and "list-inference-profiles" show for your account.
REGION=ap-south-1
MODEL_ID=apac.amazon.nova-lite-v1:0

# 1. What can I call here? Text models you can use on demand, and the inference profiles (a profile spreads requests over several Regions).
aws bedrock list-foundation-models --region $REGION --by-output-modality TEXT --by-inference-type ON_DEMAND \
  --query "modelSummaries[].[providerName,modelId]" --output table
aws bedrock list-inference-profiles --region $REGION --query "inferenceProfileSummaries[].inferenceProfileId" --output text

# 2. Ask a question through the Converse API. Keep maxTokens close to what you need, because it counts against your quota when the call starts.
aws bedrock-runtime converse --region $REGION --model-id $MODEL_ID \
  --system '[{"text":"Answer in at most three sentences."}]' \
  --messages '[{"role":"user","content":[{"text":"What is a guardrail in Amazon Bedrock?"}]}]' \
  --inference-config '{"maxTokens":200,"temperature":0.2}' \
  --query "{answer:output.message.content[0].text,stop:stopReason,tokens:usage}"

# 3. A guardrail: block hateful or attack-style prompts, mask email addresses, block card numbers. Then publish a numbered version to use.
GUARDRAIL_ID=$(aws bedrock create-guardrail --region $REGION --name support-bot \
  --blocked-input-messaging "Sorry, I can't help with that request." --blocked-outputs-messaging "Sorry, I can't share that answer." \
  --content-policy-config '{"filtersConfig":[{"type":"HATE","inputStrength":"HIGH","outputStrength":"HIGH"},{"type":"PROMPT_ATTACK","inputStrength":"HIGH","outputStrength":"NONE"}]}' \
  --sensitive-information-policy-config '{"piiEntitiesConfig":[{"type":"EMAIL","action":"ANONYMIZE"},{"type":"CREDIT_DEBIT_CARD_NUMBER","action":"BLOCK"}]}' \
  --query guardrailId --output text)
GUARDRAIL_VERSION=$(aws bedrock create-guardrail-version --region $REGION --guardrail-identifier $GUARDRAIL_ID --query version --output text)

# 4. The same question with the guardrail attached. If the guardrail steps in, stopReason is guardrail_intervened.
aws bedrock-runtime converse --region $REGION --model-id $MODEL_ID \
  --messages '[{"role":"user","content":[{"text":"My card number is 4111 1111 1111 1111, can you remember it?"}]}]' \
  --guardrail-config guardrailIdentifier=$GUARDRAIL_ID,guardrailVersion=$GUARDRAIL_VERSION \
  --query "{answer:output.message.content[0].text,stop:stopReason}"

# 5. Keep a record of prompts and answers in CloudWatch Logs. Anything users type ends up in that log group, so lock it down and set a retention period.
aws bedrock put-model-invocation-logging-configuration --region $REGION --logging-config '{"cloudWatchConfig":{"logGroupName":"/bedrock/invocations","roleArn":"arn:aws:iam::123456789012:role/bedrock-invocation-logs"},"textDataDeliveryEnabled":true,"imageDataDeliveryEnabled":false,"embeddingDataDeliveryEnabled":false}'

# 6. Your token quotas for this Region. If the call above is throttled, this is where the ceiling is.
aws service-quotas list-service-quotas --region $REGION --service-code bedrock \
  --query "Quotas[?contains(QuotaName, 'tokens per minute')].[QuotaName,Value]" --output text | head -5

# 7. Throttled calls in the last hour. The dimension is the model ID or inference profile ID you call.
aws cloudwatch get-metric-statistics --region $REGION --namespace AWS/Bedrock --metric-name InvocationThrottles \
  --dimensions Name=ModelId,Value=$MODEL_ID --statistics Sum --period 300 \
  --start-time $(date -u -d '-1 hour' +%FT%TZ) --end-time $(date -u +%FT%TZ)

# 8. An alarm for the same signal.
aws cloudwatch put-metric-alarm --region $REGION --alarm-name bedrock-throttles --namespace AWS/Bedrock --metric-name InvocationThrottles \
  --dimensions Name=ModelId,Value=$MODEL_ID --statistic Sum --period 300 --evaluation-periods 2 --threshold 20 \
  --comparison-operator GreaterThanThreshold --treat-missing-data notBreaching

# Placeholders: set the Region and the model. A least-privilege policy for the app, a guardrail with a published version,
# invocation logs in CloudWatch, and an alarm on throttled calls.
variable "region" {
  type    = string
  default = "ap-south-1"
}

variable "model_id" {
  type    = string
  default = "apac.amazon.nova-lite-v1:0"
}

provider "aws" {
  region = var.region
}

data "aws_caller_identity" "current" {}

# The app may call only this inference profile and the foundation models behind it, nothing else in Bedrock.
resource "aws_iam_policy" "invoke" {
  name = "bedrock-invoke-nova-lite"

  policy = jsonencode({
    Version = "2012-10-17"
    Statement = [{
      Effect = "Allow"
      Action = ["bedrock:InvokeModel", "bedrock:InvokeModelWithResponseStream"]
      Resource = [
        "arn:aws:bedrock:${var.region}:${data.aws_caller_identity.current.account_id}:inference-profile/${var.model_id}",
        "arn:aws:bedrock:*::foundation-model/amazon.nova-lite-v1:0",
      ]
    }]
  })
}

resource "aws_bedrock_guardrail" "support_bot" {
  name                      = "support-bot"
  blocked_input_messaging   = "Sorry, I can't help with that request."
  blocked_outputs_messaging = "Sorry, I can't share that answer."

  content_policy_config {
    filters_config {
      type            = "HATE"
      input_strength  = "HIGH"
      output_strength = "HIGH"
    }
    filters_config {
      type            = "PROMPT_ATTACK"
      input_strength  = "HIGH"
      output_strength = "NONE"
    }
  }

  sensitive_information_policy_config {
    pii_entities_config {
      type   = "EMAIL"
      action = "ANONYMIZE"
    }
    pii_entities_config {
      type   = "CREDIT_DEBIT_CARD_NUMBER"
      action = "BLOCK"
    }
  }
}

# Applications call a numbered version, so a later edit of the draft cannot change live behaviour.
resource "aws_bedrock_guardrail_version" "v1" {
  guardrail_arn = aws_bedrock_guardrail.support_bot.guardrail_arn
  description   = "First published version"
}

resource "aws_cloudwatch_log_group" "invocations" {
  name              = "/bedrock/invocations"
  retention_in_days = 30
}

data "aws_iam_policy_document" "logs_trust" {
  statement {
    actions = ["sts:AssumeRole"]
    principals {
      type        = "Service"
      identifiers = ["bedrock.amazonaws.com"]
    }
    condition {
      test     = "StringEquals"
      variable = "aws:SourceAccount"
      values   = [data.aws_caller_identity.current.account_id]
    }
  }
}

resource "aws_iam_role" "logs" {
  name               = "bedrock-invocation-logs"
  assume_role_policy = data.aws_iam_policy_document.logs_trust.json
}

resource "aws_iam_role_policy" "logs" {
  role = aws_iam_role.logs.id
  policy = jsonencode({
    Version = "2012-10-17"
    Statement = [{
      Effect   = "Allow"
      Action   = ["logs:CreateLogStream", "logs:PutLogEvents"]
      Resource = "${aws_cloudwatch_log_group.invocations.arn}:*"
    }]
  })
}

# Prompts and answers land in this log group, so treat it as sensitive data.
resource "aws_bedrock_model_invocation_logging_configuration" "this" {
  logging_config {
    text_data_delivery_enabled      = true
    image_data_delivery_enabled     = false
    embedding_data_delivery_enabled = false

    cloudwatch_config {
      log_group_name = aws_cloudwatch_log_group.invocations.name
      role_arn       = aws_iam_role.logs.arn
    }
  }
}

resource "aws_cloudwatch_metric_alarm" "throttles" {
  alarm_name          = "bedrock-throttles"
  namespace           = "AWS/Bedrock"
  metric_name         = "InvocationThrottles"
  dimensions          = { ModelId = var.model_id }
  statistic           = "Sum"
  period              = 300
  evaluation_periods  = 2
  threshold           = 20
  comparison_operator = "GreaterThanThreshold"
  treat_missing_data  = "notBreaching"
}

output "guardrail_id" {
  value = aws_bedrock_guardrail.support_bot.guardrail_id
}

output "guardrail_version" {
  value = aws_bedrock_guardrail_version.v1.version
}

# pip install boto3
# Asks a model a question through the Converse API, retries when Bedrock throttles, streams an answer,
# and checks a piece of text against a guardrail without calling a model at all.
import os
import boto3
from botocore.config import Config

REGION = os.environ.get("AWS_REGION", "ap-south-1")
MODEL_ID = os.environ.get("MODEL_ID", "apac.amazon.nova-lite-v1:0")   # replace with a model or inference profile your account can use

# "adaptive" retries slow the client down when Bedrock answers ThrottlingException, instead of hammering it.
runtime = boto3.client("bedrock-runtime", region_name=REGION,
                       config=Config(retries={"mode": "adaptive", "max_attempts": 8}, read_timeout=120))


def ask(question, system="Answer in at most three sentences.", max_tokens=300, guardrail=None):
    """Returns (text, stop_reason, usage). max_tokens counts against your quota when the request starts, so keep it close to what you need."""
    request = {
        "modelId": MODEL_ID,
        "system": [{"text": system}],
        "messages": [{"role": "user", "content": [{"text": question}]}],
        "inferenceConfig": {"maxTokens": max_tokens, "temperature": 0.2},
    }
    if guardrail:
        request["guardrailConfig"] = {"guardrailIdentifier": guardrail[0], "guardrailVersion": guardrail[1]}
    reply = runtime.converse(**request)
    text = "".join(block.get("text", "") for block in reply["output"]["message"]["content"])
    return text, reply["stopReason"], reply["usage"]


def ask_streaming(question, max_tokens=300):
    """Prints the answer as it arrives, and returns the token usage that comes with the last event."""
    stream = runtime.converse_stream(
        modelId=MODEL_ID,
        messages=[{"role": "user", "content": [{"text": question}]}],
        inferenceConfig={"maxTokens": max_tokens},
    )
    usage = {}
    for event in stream["stream"]:
        if "contentBlockDelta" in event:
            print(event["contentBlockDelta"]["delta"].get("text", ""), end="", flush=True)
        if "metadata" in event:
            usage = event["metadata"]["usage"]
    print()
    return usage


def allowed(text, guardrail_id, guardrail_version, source="INPUT"):
    """True when the guardrail lets the text through. ApplyGuardrail works on any text, including text from models that do not run on Bedrock."""
    reply = runtime.apply_guardrail(guardrailIdentifier=guardrail_id, guardrailVersion=guardrail_version, source=source,
                                    content=[{"text": {"text": text}}])
    return reply["action"] != "GUARDRAIL_INTERVENED"


def cost(usage, per_million_input, per_million_output):
    """Rough price of one call. Take the two prices from the pricing page for your model and Region."""
    return (usage["inputTokens"] * per_million_input + usage["outputTokens"] * per_million_output) / 1_000_000


if __name__ == "__main__":
    answer, stop, used = ask("What does a guardrail do in Amazon Bedrock?")
    print(answer)
    print("stop reason:", stop, "| tokens in/out:", used["inputTokens"], used["outputTokens"])
    if stop == "max_tokens":
        print("The answer was cut off. Raise max_tokens only if you need the rest.")

// dotnet add package AWSSDK.BedrockRuntime
// Sends one question through the Converse API with a guardrail attached, then reports the stop reason and the token counts.
// Exits with 1 when the guardrail blocked the request, so a pipeline can notice.
using Amazon;
using Amazon.BedrockRuntime;
using Amazon.BedrockRuntime.Model;

string modelId = Environment.GetEnvironmentVariable("MODEL_ID") ?? "apac.amazon.nova-lite-v1:0";   // replace with a model or inference profile you can use
string? guardrailId = Environment.GetEnvironmentVariable("GUARDRAIL_ID");
string guardrailVersion = Environment.GetEnvironmentVariable("GUARDRAIL_VERSION") ?? "1";

using var client = new AmazonBedrockRuntimeClient(RegionEndpoint.APSouth1);

var request = new ConverseRequest
{
    ModelId = modelId,
    System = new List<SystemContentBlock> { new SystemContentBlock { Text = "Answer in at most three sentences." } },
    Messages = new List<Message>
    {
        new Message
        {
            Role = ConversationRole.User,
            Content = new List<ContentBlock> { new ContentBlock { Text = "What does a guardrail do in Amazon Bedrock?" } }
        }
    },
    InferenceConfig = new InferenceConfiguration { MaxTokens = 300, Temperature = 0.2f }
};

if (!string.IsNullOrEmpty(guardrailId))
{
    request.GuardrailConfig = new GuardrailConfiguration
    {
        GuardrailIdentifier = guardrailId,
        GuardrailVersion = guardrailVersion,
        Trace = GuardrailTrace.Enabled
    };
}

ConverseResponse response = await client.ConverseAsync(request);

Console.WriteLine(string.Join("", response.Output.Message.Content.Select(block => block.Text)));
Console.WriteLine($"stop reason: {response.StopReason.Value} | tokens in/out: {response.Usage.InputTokens}/{response.Usage.OutputTokens}");

if (response.StopReason == StopReason.Guardrail_intervened)
{
    Console.WriteLine("The guardrail blocked this request.");
    return 1;
}
if (response.StopReason == StopReason.Max_tokens)
{
    Console.WriteLine("The answer was cut off at the token limit.");
}
return 0;