You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
This section explains the parameters in the CloudFormation template that require JSON string values. Each parameter's structure and purpose are described in detail to assist in their configuration.
133
+
134
+
### `pBedrockModelEvalBucketRuleParams`
135
+
-**Purpose**: Configures a rule to validate a Bedrock Model Evaluation bucket.
136
+
-**Structure**:
137
+
{
138
+
"deploy": "true|false",
139
+
"accounts": ["account_id1", "account_id2"],
140
+
"regions": ["region1", "region2"],
141
+
"input_params": {
142
+
"BucketName": "bucket-name"
143
+
}
144
+
}
145
+
-**Fields**:
146
+
-`deploy`: Whether the rule should be deployed (`true` or `false`).
147
+
-`accounts`: List of account IDs to apply the rule.
148
+
-`regions`: List of regions to apply the rule.
149
+
-`input_params.BucketName`: Name of the evaluation bucket.
150
+
151
+
---
152
+
153
+
### `pBedrockGuardrailsRuleParams`
154
+
-**Purpose**: Enforces governance guardrails for Bedrock resources.
155
+
-**Structure**:
156
+
{
157
+
"deploy": "true|false",
158
+
"accounts": ["account_id1", "account_id2"],
159
+
"regions": ["region1", "region2"],
160
+
"input_params": {
161
+
"content_filters": "true|false",
162
+
"denied_topics": "true|false",
163
+
"word_filters": "true|false",
164
+
"sensitive_info_filters": "true|false",
165
+
"contextual_grounding": "true|false"
166
+
}
167
+
}
168
+
-**Fields**:
169
+
-`deploy`: Whether the rule should be deployed.
170
+
-`accounts`: List of account IDs.
171
+
-`regions`: List of regions.
172
+
-`input_params`: Specifies guardrail options (`true` or `false` for each filter).
173
+
174
+
---
175
+
176
+
### `pBedrockInvocationLogCWRuleParams`
177
+
-**Purpose**: Validates CloudWatch logging for model invocations.
178
+
-**Structure**:
179
+
{
180
+
"deploy": "true|false",
181
+
"accounts": ["account_id1", "account_id2"],
182
+
"regions": ["region1", "region2"],
183
+
"input_params": {
184
+
"check_retention": "true|false",
185
+
"check_encryption": "true|false"
186
+
}
187
+
}
188
+
-**Fields**:
189
+
-`deploy`: Whether the rule should be deployed.
190
+
-`accounts`: List of account IDs.
191
+
-`regions`: List of regions.
192
+
-`input_params.check_retention`: Ensures log retention is configured.
193
+
-`input_params.check_encryption`: Ensures logs are encrypted.
194
+
195
+
---
196
+
197
+
### `pBedrockInvocationLogS3RuleParams`
198
+
-**Purpose**: Validates S3 logging for model invocations.
199
+
-**Structure**:
200
+
{
201
+
"deploy": "true|false",
202
+
"accounts": ["account_id1", "account_id2"],
203
+
"regions": ["region1", "region2"],
204
+
"input_params": {
205
+
"check_retention": "true|false",
206
+
"check_encryption": "true|false",
207
+
"check_access_logging": "true|false",
208
+
"check_object_locking": "true|false",
209
+
"check_versioning": "true|false"
210
+
}
211
+
}
212
+
-**Fields**:
213
+
-`deploy`: Whether the rule should be deployed.
214
+
-`accounts`: List of account IDs.
215
+
-`regions`: List of regions.
216
+
-`input_params.check_retention`: Ensures bucket retention policies are configured.
217
+
-`input_params.check_encryption`: Ensures bucket encryption is enabled.
218
+
-`input_params.check_access_logging`: Ensures bucket access logging is enabled.
219
+
-`input_params.check_object_locking`: Ensures bucket object locking is enabled.
220
+
-`input_params.check_versioning`: Ensures bucket versioning is enabled.
221
+
222
+
---
223
+
224
+
### `pBedrockCWEndpointsRuleParams`
225
+
-**Purpose**: Validates CloudWatch VPC endpoints.
226
+
-**Structure**:
227
+
{
228
+
"deploy": "true|false",
229
+
"accounts": ["account_id1", "account_id2"],
230
+
"regions": ["region1", "region2"],
231
+
"input_params": {}
232
+
}
233
+
-**Fields**:
234
+
-`deploy`: Whether the rule should be deployed.
235
+
-`accounts`: List of account IDs.
236
+
-`regions`: List of regions.
237
+
-`input_params`: This field is currently empty.
238
+
239
+
---
240
+
241
+
### `pBedrockS3EndpointsRuleParams`
242
+
-**Purpose**: Validates S3 VPC endpoints.
243
+
-**Structure**:
244
+
{
245
+
"deploy": "true|false",
246
+
"accounts": ["account_id1", "account_id2"],
247
+
"regions": ["region1", "region2"],
248
+
"input_params": {}
249
+
}
250
+
-**Fields**:
251
+
-`deploy`: Whether the rule should be deployed.
252
+
-`accounts`: List of account IDs.
253
+
-`regions`: List of regions.
254
+
-`input_params`: This field is currently empty.
255
+
256
+
---
257
+
258
+
### `pBedrockServiceChangesFilterParams`
259
+
-**Purpose**: Tracks changes to services in CloudTrail logs.
260
+
-**Structure**:
261
+
{
262
+
"deploy": "true|false",
263
+
"accounts": ["account_id1", "account_id2"],
264
+
"regions": ["region1", "region2"],
265
+
"filter_params": {
266
+
"log_group_name": "log-group-name"
267
+
}
268
+
}
269
+
-**Fields**:
270
+
-`deploy`: Whether the filter should be deployed.
271
+
-`accounts`: List of account IDs.
272
+
-`regions`: List of regions.
273
+
-`filter_params.log_group_name`: Name of the log group to monitor for changes.
274
+
275
+
---
276
+
277
+
### `pBedrockBucketChangesFilterParams`
278
+
-**Purpose**: Monitors S3 bucket changes in CloudTrail logs.
279
+
-**Structure**:
280
+
{
281
+
"deploy": "true|false",
282
+
"accounts": ["account_id1", "account_id2"],
283
+
"regions": ["region1", "region2"],
284
+
"filter_params": {
285
+
"log_group_name": "log-group-name",
286
+
"bucket_names": ["bucket1", "bucket2"]
287
+
}
288
+
}
289
+
-**Fields**:
290
+
-`deploy`: Whether the filter should be deployed.
291
+
-`accounts`: List of account IDs.
292
+
-`regions`: List of regions.
293
+
-`filter_params.log_group_name`: Name of the log group to monitor.
294
+
-`filter_params.bucket_names`: List of bucket names to track.
295
+
296
+
---
297
+
298
+
### `pBedrockPromptInjectionFilterParams`
299
+
-**Purpose**: Filters prompt injection attempts in logs.
300
+
-**Structure**:
301
+
{
302
+
"deploy": "true|false",
303
+
"accounts": ["account_id1", "account_id2"],
304
+
"regions": ["region1", "region2"],
305
+
"filter_params": {
306
+
"log_group_name": "log-group-name",
307
+
"input_path": "path.to.input"
308
+
}
309
+
}
310
+
-**Fields**:
311
+
-`deploy`: Whether the filter should be deployed.
312
+
-`accounts`: List of account IDs.
313
+
-`regions`: List of regions.
314
+
-`filter_params.log_group_name`: Name of the log group to monitor.
315
+
-`filter_params.input_path`: Path to the input field to check.
316
+
317
+
---
318
+
319
+
### `pBedrockSensitiveInfoFilterParams`
320
+
-**Purpose**: Filters sensitive information from logs.
321
+
-**Structure**:
322
+
{
323
+
"deploy": "true|false",
324
+
"accounts": ["account_id1", "account_id2"],
325
+
"regions": ["region1", "region2"],
326
+
"filter_params": {
327
+
"log_group_name": "log-group-name",
328
+
"input_path": "path.to.sensitive.data"
329
+
}
330
+
}
331
+
-**Fields**:
332
+
-`deploy`: Whether the filter should be deployed.
333
+
-`accounts`: List of account IDs.
334
+
-`regions`: List of regions.
335
+
-`filter_params.log_group_name`: The name of the log group to filter.
336
+
-`filter_params.input_path`: Path to the data field containing sensitive information.
337
+
338
+
---
339
+
340
+
### `pBedrockCentralObservabilityParams`
341
+
-**Purpose**: Configures central observability for Bedrock accounts.
0 commit comments