本文為英文版的機器翻譯版本，如內容有任何歧義或不一致之處，概以英文版為準。

# 在模型推論請求中強制使用特定防護機制
<a name="guardrails-permissions-id"></a>

您可以在 IAM 政策中包含 `bedrock:GuardrailIdentifier` 條件索引鍵，強制對模型推論使用特定的防護機制。這可讓您拒絕不包含 IAM 政策中設定之防護機制的任何推論 API 請求。

您可以針對下列推論 API 套用此強制執行：
+ [Converse](https://docs.aws.amazon.com/bedrock/latest/APIReference/API_runtime_Converse.html)
+ [ConverseStream](https://docs.aws.amazon.com/bedrock/latest/APIReference/API_runtime_ConverseStream.html)
+ [InvokeModel](https://docs.aws.amazon.com/bedrock/latest/APIReference/API_runtime_InvokeModel.html)
+ [InvokeModelWithResponseStream](https://docs.aws.amazon.com/bedrock/latest/APIReference/API_runtime_InvokeModelWithResponseStream.html)

下列範例是您可以使用 `bedrock:GuardrailIdentifier` 條件金鑰的一些方式。

**範例 1：強制使用特定的防護機制及其數值版本**  
使用下列政策，在模型推論期間強制使用特定防護機制 (`{{guardrail-id}}`) 及其數值版本 1。  
明確拒絕會防止使用者請求使用任何其他 `GuardrailIdentifier` 和防護機制版本呼叫列出的動作，無論使用者可能擁有哪些其他許可。    
****  

```
{
    "Version":"2012-10-17",		 	 	 
    "Statement": [
        {
            "Sid": "InvokeFoundationModelStatement1",
            "Effect": "Allow",
            "Action": [
                "bedrock:InvokeModel",
                "bedrock:InvokeModelWithResponseStream"
            ],
            "Resource": [
                "arn:aws:bedrock:{{us-east-1}}::foundation-model/*"
            ],
            "Condition": {
                "StringEquals": {
                    "bedrock:GuardrailIdentifier": "arn:aws:bedrock:{{us-east-1}}:{{123456789012}}:guardrail/{{guardrail-id}}:{{1}}"
                }
            }
        },
        {
            "Sid": "InvokeFoundationModelStatement2",
            "Effect": "Deny",
            "Action": [
                "bedrock:InvokeModel",
                "bedrock:InvokeModelWithResponseStream"
            ],
            "Resource": [
                "arn:aws:bedrock:{{us-east-1}}::foundation-model/*"
            ],
            "Condition": {
                "StringNotEquals": {
                    "bedrock:GuardrailIdentifier": "arn:aws:bedrock:{{us-east-1}}:{{123456789012}}:guardrail/{{guardrail-id}}:{{1}}"
                }
            }
        },
        {
            "Sid": "ApplyGuardrail",
            "Effect": "Allow",
            "Action": [
                "bedrock:ApplyGuardrail"
            ],
            "Resource": [
                "arn:aws:bedrock:{{us-east-1}}:{{123456789012}}:guardrail/{{guardrail-id}}"
            ]
        }
    ]
}
```

**範例 2：強制使用特定的防護機制及其 DRAFT 版本**  
使用下列政策，在模型推論期間強制使用特定防護機制 (`{{guardrail-id}}`) 及其 DRAFT 版本。    
****  

```
{
    "Version":"2012-10-17",		 	 	 
    "Statement": [
        {
            "Sid": "InvokeFoundationModelStatement1",
            "Effect": "Allow",
            "Action": [
                "bedrock:InvokeModel",
                "bedrock:InvokeModelWithResponseStream"
            ],
            "Resource": [
                "arn:aws:bedrock:{{us-east-1}}::foundation-model/*"
            ],
            "Condition": {
                "StringEquals": {
                    "bedrock:GuardrailIdentifier": "arn:aws:bedrock:{{us-east-1}}:{{123456789012}}:guardrail/{{guardrail-id}}"
                }
            }
        },
        {
            "Sid": "InvokeFoundationModelStatement2",
            "Effect": "Deny",
            "Action": [
                "bedrock:InvokeModel",
                "bedrock:InvokeModelWithResponseStream"
            ],
            "Resource": [
                "arn:aws:bedrock:{{us-east-1}}::foundation-model/*"
            ],
            "Condition": {
                "StringNotEquals": {
                    "bedrock:GuardrailIdentifier": "arn:aws:bedrock:{{us-east-1}}:{{123456789012}}:guardrail/{{guardrail-id}}"
                }
            }
        },
        {
            "Sid": "ApplyGuardrail",
            "Effect": "Allow",
            "Action": [
                "bedrock:ApplyGuardrail"
            ],
            "Resource": [
                "arn:aws:bedrock:{{us-east-1}}:{{123456789012}}:guardrail/{{guardrail-id}}"
            ]
        }
    ]
}
```

**範例 3：強制使用特定防護機制及其任何數值版本**  
使用以下政策，在模型推論期間強制使用特定防護機制 (`{{guardrail-id}}`) 及其任何數值版本。    
****  

```
{
    "Version":"2012-10-17",		 	 	 
    "Statement": [
        {
            "Sid": "InvokeFoundationModelStatement1",
            "Effect": "Allow",
            "Action": [
                "bedrock:InvokeModel",
                "bedrock:InvokeModelWithResponseStream"
            ],
            "Resource": [
                "arn:aws:bedrock:{{us-east-1}}::foundation-model/*"
            ],
            "Condition": {
                "ArnLike": {
                    "bedrock:GuardrailIdentifier": "arn:aws:bedrock:{{us-east-1}}:{{123456789012}}:guardrail/{{guardrail-id}}:*"
                }
            }
        },
        {
            "Sid": "InvokeFoundationModelStatement2",
            "Effect": "Deny",
            "Action": [
                "bedrock:InvokeModel",
                "bedrock:InvokeModelWithResponseStream"
            ],
            "Resource": [
                "arn:aws:bedrock:{{us-east-1}}::foundation-model/*"
            ],
            "Condition": {
                "ArnNotLike": {
                    "bedrock:GuardrailIdentifier": "arn:aws:bedrock:{{us-east-1}}:{{123456789012}}:guardrail/{{guardrail-id}}:*"
                }
            }
        },
        {
            "Sid": "ApplyGuardrail",
            "Effect": "Allow",
            "Action": [
                "bedrock:ApplyGuardrail"
            ],
            "Resource": [
                "arn:aws:bedrock:{{us-east-1}}:{{123456789012}}:guardrail/{{guardrail-id}}"
            ]
        }
    ]
}
```

**範例 4：強制使用特定防護機制及其任何版本**  
使用以下政策，在模型推論期間強制使用特定防護機制 (`{{guardrail-id}}`) 及其任何數值版本 (包括 DRAFT 版本)。    
****  

```
{
    "Version":"2012-10-17",		 	 	 
    "Statement": [
        {
            "Sid": "InvokeFoundationModelStatement1",
            "Effect": "Allow",
            "Action": [
                "bedrock:InvokeModel",
                "bedrock:InvokeModelWithResponseStream"
            ],
            "Resource": [
                "arn:aws:bedrock:{{us-east-1}}::foundation-model/*"
            ],
            "Condition": {
                "ArnLike": {
                    "bedrock:GuardrailIdentifier": "arn:aws:bedrock:{{us-east-1}}:{{123456789012}}:guardrail/{{guardrail-id}}*"
                }
            }
        },
        {
            "Sid": "InvokeFoundationModelStatement2",
            "Effect": "Deny",
            "Action": [
                "bedrock:InvokeModel",
                "bedrock:InvokeModelWithResponseStream"
            ],
            "Resource": [
                "arn:aws:bedrock:{{us-east-1}}::foundation-model/*"
            ],
            "Condition": {
                "ArnNotLike": {
                    "bedrock:GuardrailIdentifier": "arn:aws:bedrock:{{us-east-1}}:{{123456789012}}:guardrail/{{guardrail-id}}*"
                }
            }
        },
        {
            "Sid": "ApplyGuardrail",
            "Effect": "Allow",
            "Action": [
                "bedrock:ApplyGuardrail"
            ],
            "Resource": [
                "arn:aws:bedrock:{{us-east-1}}:{{123456789012}}:guardrail/{{guardrail-id}}"
            ]
        }
    ]
}
```

**範例 5：強制使用特定的防護機制和版本對**  
使用下列政策僅允許一組防護機制及其個別版本的模型推論。    
****  

```
{
    "Version":"2012-10-17",		 	 	 
    "Statement": [
        {
            "Sid": "InvokeFoundationModelStatement1",
            "Effect": "Allow",
            "Action": [
                "bedrock:InvokeModel",
                "bedrock:InvokeModelWithResponseStream"
            ],
            "Resource": [
                "arn:aws:bedrock:{{us-east-1}}::foundation-model/*"
            ],
            "Condition": {
                "StringEquals": {
                    "bedrock:GuardrailIdentifier": [
                        "arn:aws:bedrock:{{us-east-1}}:{{123456789012}}:guardrail/{{guardrail-1-id}}:{{1}}",
                        "arn:aws:bedrock:{{us-east-1}}:{{123456789012}}:guardrail/{{guardrail-2-id}}:{{2}}",
                        "arn:aws:bedrock:{{us-east-1}}:{{123456789012}}:guardrail/{{guardrail-3-id}}"
                    ]
                }
            }
        },
        {
            "Sid": "InvokeFoundationModelStatement2",
            "Effect": "Deny",
            "Action": [
                "bedrock:InvokeModel",
                "bedrock:InvokeModelWithResponseStream"
            ],
            "Resource": [
                "arn:aws:bedrock:{{us-east-1}}::foundation-model/*"
            ],
            "Condition": {
                "StringNotEquals": {
                    "bedrock:GuardrailIdentifier": [
                        "arn:aws:bedrock:{{us-east-1}}:{{123456789012}}:guardrail/{{guardrail-1-id}}:{{1}}",
                        "arn:aws:bedrock:{{us-east-1}}:{{123456789012}}:guardrail/{{guardrail-2-id}}:{{2}}",
                        "arn:aws:bedrock:{{us-east-1}}:{{123456789012}}:guardrail/{{guardrail-3-id}}"
                    ]
                }
            }
        },
        {
            "Sid": "ApplyGuardrail",
            "Effect": "Allow",
            "Action": [
                "bedrock:ApplyGuardrail"
            ],
            "Resource": [
                "arn:aws:bedrock:{{us-east-1}}:{{123456789012}}:guardrail/{{guardrail-1-id}}",
                "arn:aws:bedrock:{{us-east-1}}:{{123456789012}}:guardrail/{{guardrail-2-id}}",
                "arn:aws:bedrock:{{us-east-1}}:{{123456789012}}:guardrail/{{guardrail-3-id}}"
            ]
        }
    ]
}
```

**限制**  
如果使用者擔任的 IAM 角色具有使用 `bedrock:GuardrailIdentifier` 條件索引鍵設定的特定防護機制：  
+ 使用者不應使用具有其他許可的相同角色來調用 Bedrock API，例如代表使用者進行 `InvokeModel` 呼叫的 `RetrieveAndGenerate` 和 `InvokeAgent`。即使請求中指定了防護機制，這仍可能會導致存取遭拒的錯誤，因為 `RetrieveAndGenerate` 和 `InvokeAgent` 會進行多次 `InvokeModel` 呼叫，而其中一些呼叫不包含防護機制。
+ 使用者可以使用[防護機制輸入標籤](guardrails-tagging.md)，略過在其提示中套用防護機制。不過，防護機制一律會套用至回應。
+ 由於 Amazon Bedrock 防護機制目前不支援跨帳戶存取權的資源型政策，因此您的防護機制必須與提出請求的 IAM 角色位於相同 AWS 帳戶 。