Policy: AWS > Bedrock > Guardrail > Settings > Sensitive Information Policy > Regexes Config

List of custom regex patterns the guardrail should detect, anonymize, or block. An empty list (the default) means "not configured" and is excluded from the diff and the enforced sensitiveInformationPolicyConfig.

The optional inputAction / outputAction / inputEnabled / outputEnabled fields per-pattern override the guardrail-wide action for that direction.

Targets

This policy targets the following resource types:

AWS > Bedrock > Guardrail

Primary Policy

This policy is used with the following primary policy:

AWS > Bedrock > Guardrail > Settings > Sensitive Information Policy

Controls

Setting this policy configures this control:

AWS > Bedrock > Guardrail > Settings

Policy Specification

Schema Type	`array`
Default	`[]`
Examples [YAML]	`- name: ssn pattern: \d{3}-\d{2}-\d{4} action: BLOCK` `- name: ssn pattern: \d{3}-\d{2}-\d{4} action: BLOCK - name: internal-id pattern: EMP-\d{6} action: ANONYMIZE`

In Your Workspace

Policy Settings by Type report

Developers

Category URI

tmod:@turbot/turbot#/control/categories/security

Policy Type URI

tmod:@turbot/aws-bedrock#/policy/types/bedrockGuardrailSettingsSensitiveInformationPolicyRegexesConfig

GraphQL

query policyType(id: "tmod:@turbot/aws-bedrock#/policy/types/bedrockGuardrailSettingsSensitiveInformationPolicyRegexesConfig") { … }

query policySettings(filter: "policyTypeId:'tmod:@turbot/aws-bedrock#/policy/types/bedrockGuardrailSettingsSensitiveInformationPolicyRegexesConfig'") { … }

query policyValues(filter: "policyTypeId:'tmod:@turbot/aws-bedrock#/policy/types/bedrockGuardrailSettingsSensitiveInformationPolicyRegexesConfig'") { … }

CLI

Get Policy Type

turbot graphql policy-type --id "tmod:@turbot/aws-bedrock#/policy/types/bedrockGuardrailSettingsSensitiveInformationPolicyRegexesConfig"

Get Policy Settings

turbot graphql policy-settings --filter "policyTypeId:tmod:@turbot/aws-bedrock#/policy/types/bedrockGuardrailSettingsSensitiveInformationPolicyRegexesConfig"