Bedrock Guardrails
Amazon Bedrock Guardrails is a managed AWS service that filters prompts and model responses against content, topic and sensitive-data policies.
▸ WHAT IT DOES
A guardrail in Amazon Bedrock is a named, versioned set of filters. There are six kinds: content filters for hate, insults, sexual content, violence, misconduct and prompt attacks, in text and images; denied topics that you describe yourself; word filters; sensitive information filters that block or mask personal data, including patterns you define as regular expressions; contextual grounding checks that test whether a response is grounded in its source material and relevant to the user's query; and Automated Reasoning checks that validate a response against a set of logical rules.
A guardrail is applied in one of two ways. It can be attached to a model call on Bedrock by passing its ID and version, in which case it evaluates both the prompt and the completion. Or content can be sent to the ApplyGuardrail API, which evaluates text or images without invoking a model, so the same guardrail can cover models hosted outside Bedrock. Content filters and denied topics come in two tiers, Classic and Standard, at the same price.
▸ OWNER, LICENSE AND HOSTING
| Fact | Value | Source and date checked |
|---|---|---|
| Owner | Amazon Web Services (AWS). | SOURCE ↗ 12 OCT 2026 |
| License | Proprietary managed service. AWS publishes no source code or license for it. | SOURCE ↗ 12 OCT 2026 |
| Self-hosting | No. It runs in AWS. The ApplyGuardrail API can check content for models you host yourself, but the check itself runs in AWS. | SOURCE ↗ 12 OCT 2026 |
| Hosted regions | 25 AWS Regions are listed, among them N. Virginia, Ohio, Oregon, Canada (Central), Frankfurt, Stockholm, Ireland, London, Paris, Tokyo, Singapore, Sydney and AWS GovCloud (US-West). | SOURCE ↗ 12 OCT 2026 |
Each value was read from the vendor's own page on the date shown. How listings are checked
▸ PLANS AND PRICES
| Plan | Price | Included usage | Beyond that | Data retention | Users |
|---|---|---|---|---|---|
| Content filters (text) | $0.15 per 1,000 text units | – | – | – | – |
| Content filters (image) | $0.00075 per image processed | – | – | – | – |
| Denied topics | $0.15 per 1,000 text units | – | – | – | – |
| Sensitive information filters | $0.10 per 1,000 text units | – | – | – | – |
| Sensitive information filters (regular expression) | Free | – | – | – | – |
| Word filters | Free | – | – | – | – |
| Contextual grounding checks | $0.10 per 1,000 text units | – | – | – | – |
| Automated Reasoning checks | $0.17 per 1,000 text units per Automated Reasoning policy | – | – | – | – |
There are no plans: each row is a filter, and you pay only for the filters a guardrail uses. A text unit holds up to 1,000 characters, so a 5,600-character input is charged as 6 text units. Prices are the same for the Standard and Classic tiers. Contextual grounding counts the characters of the source, the query and the response together. Cross-Region guardrail inference has no additional cost. A separate InvokeGuardrailChecks API is priced lower: $0.07 for content filters, $0.08 for prompt attack and $0.10 for sensitive information filters, each per 1,000 text units.
As stated on the vendor's pricing page on 12 OCT 2026. A dash means the page does not say.
▸ PRICING HISTORY
The pricing page is checked daily. The first check has not run yet.
▸ WHERE IT FITS
Teams already on AWS that want policy checks without running a service of their own. The ApplyGuardrail API is not tied to a Bedrock model, so one guardrail can cover models hosted elsewhere, and guardrails can be shared across the accounts of an AWS organization.
▸ WHAT TO KNOW FIRST
Each filter is billed separately, so a guardrail with content filters, denied topics and sensitive information filters costs $0.40 per 1,000 text units. Classic tier supports English, French and Spanish only; Standard tier uses cross-Region inference, so prompts can leave the primary Region within its geography. Reasoning content blocks are not evaluated. AWS lists models on Bedrock that do not accept a guardrail, among them embedding, reranking and speech models and OpenAI's GPT 5.4 and GPT 5.5.