bedrock-guardrails

When to invoke

Use when: "bedrock guardrails", "review our bedrock setup", "is bedrock locked to eu-central-1", "do we leak PII into prompts", "bedrock IAM policy", "tenant isolation for the knowledge base", "EU data residency for the LLM feature", or when a PR adds a Bedrock invoke and nobody has looked at the surrounding controls yet.

Preamble

eval "$(~/.vibestack/bin/vibe-slug 2>/dev/null)" 2>/dev/null || SLUG="unknown"
_LEARN_FILE="${VIBESTACK_HOME:-$HOME/.vibestack}/projects/${SLUG:-unknown}/learnings.jsonl"
if [ -f "$_LEARN_FILE" ]; then
  _LEARN_COUNT=$(wc -l < "$_LEARN_FILE" 2>/dev/null | tr -d ' ')
  echo "LEARNINGS: $_LEARN_COUNT entries loaded"
  if [ "$_LEARN_COUNT" -gt 5 ] 2>/dev/null; then
    ~/.vibestack/bin/vibe-learnings-search --limit 5 2>/dev/null || true
  fi
else
  echo "LEARNINGS: none yet"
fi

{{include lib/snippets/session-host.md}}

{{include lib/snippets/decision-brief.md}}

{{include lib/snippets/working-protocols.md}}

{{include lib/snippets/state-protocols.md}}

User-invocable

When the user types /bedrock-guardrails, run this skill.

Step 1: Locate Bedrock usage and decide the residency regime

Find every place the repo talks to Bedrock. Search infrastructure code and application code separately, because the controls live in different files.

The inventory has to be complete: a call site missed here is skipped by every region, IAM, guardrail, logging and cost check downstream, and shows up in the report as nothing at all. So neither search is truncated, and both cover the whole current invocation surface — InvokeModel, InvokeModelWithResponseStream, Converse, ConverseStream, StartAsyncInvoke, ApplyGuardrail, InvokeGuardrailChecks, RetrieveAndGenerate, RetrieveAndGenerateStream, InvokeAgent, InvokeInlineAgent, InvokeFlow, and the OpenAI-compatible chat/completions and responses paths on the bedrock-runtime endpoint.

grep -rnE 'aws_bedrock|bedrock:|AWS::Bedrock|aws_bedrockagent|bedrock_guardrail' \
  --include='*.tf' --include='*.tf.json' --include='*.hcl' --include='*.yaml' --include='*.yml' --include='*.json' --include='*.ts' --include='*.py' . 2>/dev/null \
  | grep -vE 'node_modules|\.terraform/|dist/|build/|vendor/'

grep -rnE 'bedrock-(agent-)?runtime|Bedrock(Agent)?Runtime|bedrock_(agent_)?runtime|client\(["'"'"']bedrock|@aws-sdk/client-bedrock|[Ii]nvoke[_]?[Mm]odel([Ww]ith[Rr]esponse[Ss]tream|_with_response_stream)?|[Cc]onverse([_]?[Ss]tream)?[[:space:]]*[(A-Za-z]|[Rr]etrieve[_]?[Aa]nd[_]?[Gg]enerate([_]?[Ss]tream)?|[Ii]nvoke[_]?([Ii]nline[_]?)?[Aa]gent|[Ii]nvoke[_]?[Ff]low|[Ss]tart[_]?[Aa]sync[_]?[Ii]nvoke|[Aa]pply[_]?[Gg]uardrail|[Ii]nvoke[_]?[Gg]uardrail[_]?[Cc]hecks|chat/completions|/v1/responses' \
  --include='*.py' --include='*.ts' --include='*.tsx' --include='*.js' --include='*.jsx' --include='*.mjs' --include='*.go' --include='*.java' --include='*.kt' --include='*.rb' --include='*.cs' --include='*.rs' --include='*.php' . 2>/dev/null \
  | grep -vE 'node_modules|\.terraform/|dist/|build/|vendor/|_test\.|\.test\.|spec\.'