Ravi Sir's Cards › AWS
Guardrails and IAM
This revision card explains Guardrails and IAM. An agent with broad Lambda rights can leak or mutate data when prompted badly. It describes use Bedrock Guardrails, least-privilege agent roles, and input/output checks on every action. The how-to section notes scope IAM to specific Lambda ARNs; deny destructive actions unless required; log InvokeAgent. An example on the card is prompt injection trying “dump all users” fails action auth and is logged for review.
Read card text
What this card says
Why do we need it?
An agent with broad Lambda rights can leak or mutate data when prompted badly.
What is it?
Use Bedrock Guardrails, least-privilege agent roles, and input/output checks on every action.
Guardrails
How to do it
Scope IAM to specific Lambda ARNs; deny destructive actions unless required; log InvokeAgent.
Example
Prompt injection trying “dump all users” fails action auth and is logged for review.