Policy: AWS > Bedrock > Guardrail > Settings > KMS Key

ARN of the customer-managed KMS key used to encrypt the guardrail. Must be the full KEY ARN (not the alias ARN, the bare key ID, or the alias name). AWS Bedrock resolves alias ARNs to the underlying key ARN on write, which would cause the reconciler to alarm on every cycle comparing the customer-supplied alias to the AWS-resolved key. Leave empty to preserve the guardrail's existing KMS configuration.

Targets

This policy targets the following resource types:

AWS > Bedrock > Guardrail

Primary Policy

This policy is used with the following primary policy:

AWS > Bedrock > Guardrail > Settings

Controls

Setting this policy configures this control:

AWS > Bedrock > Guardrail > Settings

Policy Specification

Schema Type	`string`
Examples [YAML]	arn:aws:kms:us-east-1:123456789012:key/abcd1234-12ab-34cd-56ef-1234567890ab

In Your Workspace

Policy Settings by Type report

Developers

Category URI

tmod:@turbot/turbot#/control/categories/security

Policy Type URI

tmod:@turbot/aws-bedrock#/policy/types/bedrockGuardrailSettingsKmsKey

GraphQL

query policyType(id: "tmod:@turbot/aws-bedrock#/policy/types/bedrockGuardrailSettingsKmsKey") { … }

query policySettings(filter: "policyTypeId:'tmod:@turbot/aws-bedrock#/policy/types/bedrockGuardrailSettingsKmsKey'") { … }

query policyValues(filter: "policyTypeId:'tmod:@turbot/aws-bedrock#/policy/types/bedrockGuardrailSettingsKmsKey'") { … }

CLI

Get Policy Type

turbot graphql policy-type --id "tmod:@turbot/aws-bedrock#/policy/types/bedrockGuardrailSettingsKmsKey"

Get Policy Settings

turbot graphql policy-settings --filter "policyTypeId:tmod:@turbot/aws-bedrock#/policy/types/bedrockGuardrailSettingsKmsKey"