Conan Scott
feb44be76b
Adds an Amazon Bedrock Guardrail (PROMPT_ATTACK, HIGH, input) plus a dedicated least-privilege IAM user for Fusion's AWS-Guardrail integration, so the gateway screens inbound prompts for injection/jailbreak before de-id or the agent run. Outputs the region/id/version/access-key for the Fusion console (secret stays in gitignored state). Verified live: benign -> NONE, injection -> GUARDRAIL_INTERVENED. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
67 lines
2.6 KiB
HCL
67 lines
2.6 KiB
HCL
# ---------------------------------------------------------------------------
|
|
# Amazon Bedrock Guardrail for Fusion's "AWS Guardrail" integration. This makes
|
|
# the demo a real AI-gateway policy: Fusion calls Bedrock ApplyGuardrail on the
|
|
# traffic (independent of the model) to screen for PROMPT INJECTION / jailbreak.
|
|
#
|
|
# Fusion (shared SaaS) needs static AWS creds, so we mint a dedicated IAM user
|
|
# scoped to bedrock:ApplyGuardrail on THIS guardrail only. In the Fusion console
|
|
# you enter: region, guardrail id, guardrail version, access key, secret key.
|
|
# ---------------------------------------------------------------------------
|
|
|
|
resource "aws_bedrock_guardrail" "injection" {
|
|
name = "${local.name}-injection"
|
|
description = "Prompt-injection / jailbreak screening for the HNCB AI gateway demo."
|
|
blocked_input_messaging = "Blocked by the HNCB AI gateway guardrail: this request looks like a prompt-injection attempt."
|
|
blocked_outputs_messaging = "Blocked by the HNCB AI gateway guardrail."
|
|
|
|
# Prompt-attack detection is input-only, so output_strength must be NONE.
|
|
content_policy_config {
|
|
filters_config {
|
|
type = "PROMPT_ATTACK"
|
|
input_strength = "HIGH"
|
|
output_strength = "NONE"
|
|
}
|
|
}
|
|
|
|
tags = local.cloud_tag
|
|
}
|
|
|
|
# A numbered, published version (Fusion needs id + version, not DRAFT).
|
|
resource "aws_bedrock_guardrail_version" "injection" {
|
|
guardrail_arn = aws_bedrock_guardrail.injection.guardrail_arn
|
|
description = "v1 - prompt attack HIGH"
|
|
}
|
|
|
|
# Dedicated IAM user for Fusion SaaS to call ApplyGuardrail (least privilege).
|
|
resource "aws_iam_user" "fusion_guardrail" {
|
|
name = "${local.name}-fusion-guardrail"
|
|
tags = local.cloud_tag
|
|
}
|
|
|
|
resource "aws_iam_user_policy" "fusion_guardrail" {
|
|
name = "apply-guardrail"
|
|
user = aws_iam_user.fusion_guardrail.name
|
|
policy = jsonencode({
|
|
Version = "2012-10-17"
|
|
Statement = [{
|
|
Effect = "Allow"
|
|
Action = ["bedrock:ApplyGuardrail"]
|
|
Resource = [aws_bedrock_guardrail.injection.guardrail_arn]
|
|
}]
|
|
})
|
|
}
|
|
|
|
resource "aws_iam_access_key" "fusion_guardrail" {
|
|
user = aws_iam_user.fusion_guardrail.name
|
|
}
|
|
|
|
# --- Values to paste into the Fusion AWS-Guardrail integration ---
|
|
output "guardrail_region" { value = var.region }
|
|
output "guardrail_id" { value = aws_bedrock_guardrail.injection.guardrail_id }
|
|
output "guardrail_version" { value = aws_bedrock_guardrail_version.injection.version }
|
|
output "fusion_guardrail_access_key_id" { value = aws_iam_access_key.fusion_guardrail.id }
|
|
output "fusion_guardrail_secret_access_key" {
|
|
value = aws_iam_access_key.fusion_guardrail.secret
|
|
sensitive = true
|
|
}
|