Route Amazon Bedrock Guardrails interventions to Amazon Security Lake
Summary
Amazon Bedrock Guardrails are security controls that block harmful prompts and redact sensitive data in AI applications, but security teams need to see this guardrail intervention data alongside other security alerts. This article explains how to route guardrail intervention events to Amazon Security Lake (a centralized security data repository), where they can be queried together with identity, network, and application security data using tools like Amazon Athena to investigate AI-related incidents.
Solution / Mitigation
Build an automated pipeline using a CloudWatch Logs subscription filter, AWS Lambda transformation, and Amazon S3 to capture Amazon Bedrock model invocation logs containing guardrail trace data, transform matching intervention events into OCSF-compliant (Open Cybersecurity Schema Framework, a standardized format for security events) Detection Finding records (class_uid 2004), and deliver them to Amazon Security Lake as Parquet files for querying and correlation with other security data.
Classification
Affected Vendors
Related Issues
Original source: https://aws.amazon.com/blogs/security/route-amazon-bedrock-guardrails-interventions-to-amazon-security-lake/
First tracked: August 6, 2026 at 08:01 PM
Classified by LLM (prompt v3) · confidence: 85%