AWS Bedrock Best Practices Report

Overview

This report assesses AWS resources against 13 enabled configuration checks across the areas below. It identifies passed and failed checks, unavailable evidence, and affected resources so you can prioritize configuration changes and investigate operational gaps.

Bedrock Batch Inference Jobs

• Bedrock Batch Inference Jobs Run Inside a VPC

Bedrock Custom Models

• Bedrock Custom Model Import Uses Customer-Managed KMS Key with Required Key Policy
• Custom Bedrock Model Import/Customization Jobs Run Inside a VPC
• Bedrock Custom Model Jobs Use Customer-Managed KMS Key
• Bedrock Managed Customization/Hosting In Use
• Check for Missing Bedrock Model Customization Job Security Groups

Bedrock Guardrails

• Bedrock Guardrails Encrypted with Customer-Managed KMS Key
• Configure Prompt Attack Strength for Amazon Bedrock Guardrails
• Bedrock Guardrails Sensitive Information Filters Configured

Bedrock Model Evaluation Jobs

• Bedrock Model Evaluation Jobs Use Customer-Managed KMS Key
• Bedrock Evaluation Jobs Have Prompt Dataset Configured

Bedrock Model Invocation Logging

• Amazon Bedrock Model Invocation Logging Enabled

Bedrock Private Connectivity

• Bedrock Private Connectivity Redundant Across Availability Zones

The report includes actionable findings and remediation guidance for supported checks.