Skip to main content
resource · aws

Amazon Bedrock Guardrail

live rule families
2
schedulable
no
category
ai-ml-services

Does ZopNight manage Amazon Bedrock Guardrail?

Bedrock guardrails bill per text unit evaluated, with each enabled policy type metering separately, so a guardrail is a per-request surcharge on every model call it inspects. ZopNight discovers guardrails via its Bedrock provider on the 6-hour cycle and tracks evaluation cost from Cost Explorer or CUR 2.0 against traffic.

At a glance

Amazon Bedrock Guardrail coverage facts.
Field Value
Scheduling notesdiscovery and cost tracking only.

A Bedrock guardrail applies configurable content and safety policies to model calls, billed per text unit evaluated. Guardrail charges scale with every request they inspect, adding a per-call surcharge to inference traffic.

The inspection surcharge

Guardrails meter on text units, normalized chunks of the input and output they evaluate, and each policy category enabled on the guardrail carries its own per-unit rate: content filters, denied topics, sensitive-information filters, and contextual grounding checks each meter what they inspect. The cost model is therefore a multiplication attached to someone else’s traffic: whatever volume the guarded application drives, the guardrail bills a slice of it, per policy, on both the prompt and the response. Enabling one more policy type raises the rate on every future request; attaching the guardrail to one more application raises the volume.

Safety spend, kept proportional

ZopNight’s Bedrock provider discovers guardrails on the 6-hour cycle and tracks evaluation cost from Cost Explorer or CUR 2.0 with usage trends. Guardrails are not a resource anyone should race to switch off, and the posture reflects that: the value is proportionality, keeping the inspection surcharge visible next to the inference it protects. A guardrail whose evaluation cost rivals its application’s model cost signals a configuration worth examining. The usual cause is maximal policies applied uniformly where the risk profile varies by endpoint.

Where inspection over-applies

The common excesses: every policy type enabled on every guardrail because the console made it one checklist, billing grounding checks on traffic with no retrieval to ground; internal and experimental workloads inheriting the production guardrail, paying safety rates to inspect developers talking to test prompts; and duplicated evaluation, where both an application-level and a team-level guardrail inspect the same exchange twice.

Guardrail configuration review

The Bedrock console’s Guardrails view lists each guardrail with its policies and versions. The review pairs each attached application with the policies it actually needs. Per-endpoint tailoring is where the surcharge and the risk profile get back into proportion.

See it fire on your bill.

Connect an account read-only. The first findings land in minutes.

417 rule families across 353 resource types on 22 platforms. Every threshold, metric, and IAM action is documented on these pages before you grant anything.

417 rule families documented
353 resource types covered
read-only default access level
Multi-cloud automation· Production-ready in 30 min· SOC 2 · ISO 27001· 20–60% off the bill, first month· 4 platforms · 1 console· Multi-cloud automation· Production-ready in 30 min· SOC 2 · ISO 27001· 20–60% off the bill, first month· 4 platforms · 1 console·