本文属于机器翻译版本。若本译文内容与英语原文存在差异，则一律以英文原文为准。

# 在模型推理请求中强制使用特定护栏
<a name="guardrails-permissions-id"></a>

您可以通过在 IAM 策略中添加 `bedrock:GuardrailIdentifier` 条件键，来强制为模型推理使用特定护栏。这样，您就可以拒绝任何未包含您的 IAM 策略中配置的护栏的推理 API 请求。

您可以将此强制应用于以下推理 API：
+ [Converse](https://docs.aws.amazon.com/bedrock/latest/APIReference/API_runtime_Converse.html)
+ [ConverseStream](https://docs.aws.amazon.com/bedrock/latest/APIReference/API_runtime_ConverseStream.html)
+ [InvokeModel](https://docs.aws.amazon.com/bedrock/latest/APIReference/API_runtime_InvokeModel.html)
+ [InvokeModelWithResponseStream](https://docs.aws.amazon.com/bedrock/latest/APIReference/API_runtime_InvokeModelWithResponseStream.html)

以下示例展示了使用 `bedrock:GuardrailIdentifier` 条件键的一些方式。

**示例 1：强制使用特定护栏及其数字版本**  
在模型推理期间，使用以下策略强制使用特定护栏（`{{guardrail-id}}`）及其数字版本 1。  
显式拒绝会阻止用户调用具有任何其他 `GuardrailIdentifier` 和护栏版本的所列操作，无论该用户可能具有哪些其他权限。    
****  

```
{
    "Version":"2012-10-17",		 	 	 
    "Statement": [
        {
            "Sid": "InvokeFoundationModelStatement1",
            "Effect": "Allow",
            "Action": [
                "bedrock:InvokeModel",
                "bedrock:InvokeModelWithResponseStream"
            ],
            "Resource": [
                "arn:aws:bedrock:{{us-east-1}}::foundation-model/*"
            ],
            "Condition": {
                "StringEquals": {
                    "bedrock:GuardrailIdentifier": "arn:aws:bedrock:{{us-east-1}}:{{123456789012}}:guardrail/{{guardrail-id}}:{{1}}"
                }
            }
        },
        {
            "Sid": "InvokeFoundationModelStatement2",
            "Effect": "Deny",
            "Action": [
                "bedrock:InvokeModel",
                "bedrock:InvokeModelWithResponseStream"
            ],
            "Resource": [
                "arn:aws:bedrock:{{us-east-1}}::foundation-model/*"
            ],
            "Condition": {
                "StringNotEquals": {
                    "bedrock:GuardrailIdentifier": "arn:aws:bedrock:{{us-east-1}}:{{123456789012}}:guardrail/{{guardrail-id}}:{{1}}"
                }
            }
        },
        {
            "Sid": "ApplyGuardrail",
            "Effect": "Allow",
            "Action": [
                "bedrock:ApplyGuardrail"
            ],
            "Resource": [
                "arn:aws:bedrock:{{us-east-1}}:{{123456789012}}:guardrail/{{guardrail-id}}"
            ]
        }
    ]
}
```

**示例 2：强制使用特定护栏及其草稿版本**  
在模型推理期间，借助以下策略强制使用特定护栏（`{{guardrail-id}}`）及其草稿版本。    
****  

```
{
    "Version":"2012-10-17",		 	 	 
    "Statement": [
        {
            "Sid": "InvokeFoundationModelStatement1",
            "Effect": "Allow",
            "Action": [
                "bedrock:InvokeModel",
                "bedrock:InvokeModelWithResponseStream"
            ],
            "Resource": [
                "arn:aws:bedrock:{{us-east-1}}::foundation-model/*"
            ],
            "Condition": {
                "StringEquals": {
                    "bedrock:GuardrailIdentifier": "arn:aws:bedrock:{{us-east-1}}:{{123456789012}}:guardrail/{{guardrail-id}}"
                }
            }
        },
        {
            "Sid": "InvokeFoundationModelStatement2",
            "Effect": "Deny",
            "Action": [
                "bedrock:InvokeModel",
                "bedrock:InvokeModelWithResponseStream"
            ],
            "Resource": [
                "arn:aws:bedrock:{{us-east-1}}::foundation-model/*"
            ],
            "Condition": {
                "StringNotEquals": {
                    "bedrock:GuardrailIdentifier": "arn:aws:bedrock:{{us-east-1}}:{{123456789012}}:guardrail/{{guardrail-id}}"
                }
            }
        },
        {
            "Sid": "ApplyGuardrail",
            "Effect": "Allow",
            "Action": [
                "bedrock:ApplyGuardrail"
            ],
            "Resource": [
                "arn:aws:bedrock:{{us-east-1}}:{{123456789012}}:guardrail/{{guardrail-id}}"
            ]
        }
    ]
}
```

**示例 3：强制使用特定护栏及其任一数字版本**  
在模型推理期间，借助以下策略强制使用特定护栏（`{{guardrail-id}}`）及其任一数字版本。    
****  

```
{
    "Version":"2012-10-17",		 	 	 
    "Statement": [
        {
            "Sid": "InvokeFoundationModelStatement1",
            "Effect": "Allow",
            "Action": [
                "bedrock:InvokeModel",
                "bedrock:InvokeModelWithResponseStream"
            ],
            "Resource": [
                "arn:aws:bedrock:{{us-east-1}}::foundation-model/*"
            ],
            "Condition": {
                "ArnLike": {
                    "bedrock:GuardrailIdentifier": "arn:aws:bedrock:{{us-east-1}}:{{123456789012}}:guardrail/{{guardrail-id}}:*"
                }
            }
        },
        {
            "Sid": "InvokeFoundationModelStatement2",
            "Effect": "Deny",
            "Action": [
                "bedrock:InvokeModel",
                "bedrock:InvokeModelWithResponseStream"
            ],
            "Resource": [
                "arn:aws:bedrock:{{us-east-1}}::foundation-model/*"
            ],
            "Condition": {
                "ArnNotLike": {
                    "bedrock:GuardrailIdentifier": "arn:aws:bedrock:{{us-east-1}}:{{123456789012}}:guardrail/{{guardrail-id}}:*"
                }
            }
        },
        {
            "Sid": "ApplyGuardrail",
            "Effect": "Allow",
            "Action": [
                "bedrock:ApplyGuardrail"
            ],
            "Resource": [
                "arn:aws:bedrock:{{us-east-1}}:{{123456789012}}:guardrail/{{guardrail-id}}"
            ]
        }
    ]
}
```

**示例 4：强制使用特定护栏及其任一版本**  
在模型推理期间，借助以下策略强制使用特定护栏（`{{guardrail-id}}`）及其任一数字版本（包括草稿版本）。    
****  

```
{
    "Version":"2012-10-17",		 	 	 
    "Statement": [
        {
            "Sid": "InvokeFoundationModelStatement1",
            "Effect": "Allow",
            "Action": [
                "bedrock:InvokeModel",
                "bedrock:InvokeModelWithResponseStream"
            ],
            "Resource": [
                "arn:aws:bedrock:{{us-east-1}}::foundation-model/*"
            ],
            "Condition": {
                "ArnLike": {
                    "bedrock:GuardrailIdentifier": "arn:aws:bedrock:{{us-east-1}}:{{123456789012}}:guardrail/{{guardrail-id}}*"
                }
            }
        },
        {
            "Sid": "InvokeFoundationModelStatement2",
            "Effect": "Deny",
            "Action": [
                "bedrock:InvokeModel",
                "bedrock:InvokeModelWithResponseStream"
            ],
            "Resource": [
                "arn:aws:bedrock:{{us-east-1}}::foundation-model/*"
            ],
            "Condition": {
                "ArnNotLike": {
                    "bedrock:GuardrailIdentifier": "arn:aws:bedrock:{{us-east-1}}:{{123456789012}}:guardrail/{{guardrail-id}}*"
                }
            }
        },
        {
            "Sid": "ApplyGuardrail",
            "Effect": "Allow",
            "Action": [
                "bedrock:ApplyGuardrail"
            ],
            "Resource": [
                "arn:aws:bedrock:{{us-east-1}}:{{123456789012}}:guardrail/{{guardrail-id}}"
            ]
        }
    ]
}
```

**示例 5：强制使用特定护栏和版本组合**  
通过以下策略，仅允许模型推理使用一组护栏及其相应版本。    
****  

```
{
    "Version":"2012-10-17",		 	 	 
    "Statement": [
        {
            "Sid": "InvokeFoundationModelStatement1",
            "Effect": "Allow",
            "Action": [
                "bedrock:InvokeModel",
                "bedrock:InvokeModelWithResponseStream"
            ],
            "Resource": [
                "arn:aws:bedrock:{{us-east-1}}::foundation-model/*"
            ],
            "Condition": {
                "StringEquals": {
                    "bedrock:GuardrailIdentifier": [
                        "arn:aws:bedrock:{{us-east-1}}:{{123456789012}}:guardrail/{{guardrail-1-id}}:{{1}}",
                        "arn:aws:bedrock:{{us-east-1}}:{{123456789012}}:guardrail/{{guardrail-2-id}}:{{2}}",
                        "arn:aws:bedrock:{{us-east-1}}:{{123456789012}}:guardrail/{{guardrail-3-id}}"
                    ]
                }
            }
        },
        {
            "Sid": "InvokeFoundationModelStatement2",
            "Effect": "Deny",
            "Action": [
                "bedrock:InvokeModel",
                "bedrock:InvokeModelWithResponseStream"
            ],
            "Resource": [
                "arn:aws:bedrock:{{us-east-1}}::foundation-model/*"
            ],
            "Condition": {
                "StringNotEquals": {
                    "bedrock:GuardrailIdentifier": [
                        "arn:aws:bedrock:{{us-east-1}}:{{123456789012}}:guardrail/{{guardrail-1-id}}:{{1}}",
                        "arn:aws:bedrock:{{us-east-1}}:{{123456789012}}:guardrail/{{guardrail-2-id}}:{{2}}",
                        "arn:aws:bedrock:{{us-east-1}}:{{123456789012}}:guardrail/{{guardrail-3-id}}"
                    ]
                }
            }
        },
        {
            "Sid": "ApplyGuardrail",
            "Effect": "Allow",
            "Action": [
                "bedrock:ApplyGuardrail"
            ],
            "Resource": [
                "arn:aws:bedrock:{{us-east-1}}:{{123456789012}}:guardrail/{{guardrail-1-id}}",
                "arn:aws:bedrock:{{us-east-1}}:{{123456789012}}:guardrail/{{guardrail-2-id}}",
                "arn:aws:bedrock:{{us-east-1}}:{{123456789012}}:guardrail/{{guardrail-3-id}}"
            ]
        }
    ]
}
```

**限制**  
如果用户代入拥有使用 `bedrock:GuardrailIdentifier` 条件键配置的特定护栏的 IAM 角色：  
+ 用户不应使用具有额外权限的相同角色来调用 Bedrock API（如 `RetrieveAndGenerate` 和 `InvokeAgent`），这些 API 会代表用户进行 `InvokeModel` 调用。即使在请求中指定了护栏，这也可能导致访问被拒绝错误，因为 `RetrieveAndGenerate` 和 `InvokeAgent` 进行了多次 `InvokeModel` 调用，其中一些调用未包含护栏。
+ 用户可以通过使用[护栏输入标签](guardrails-tagging.md)来绕过在提示中应用护栏。但是，护栏始终应用于响应。
+ 由于 Amazon Bedrock 护栏目前不支持基于资源的跨账户访问策略，因此您的护栏必须与发出请求的 IAM 角色位于同一 AWS 账户 。