Mask content instead of blocking it
Configure the AI AWS Guardrails policy to mask the content that violates your guardrail instead of blocking the request or response. Streaming is disabled while masking is enabled.
Prerequisites
-
An AWS Bedrock Guardrails policy and access to the AWS Bedrock Guardrails service.
-
An existing AI Model.
Environment variables
-
GUARDRAILS_ID: The guardrail identifier to apply. -
GUARDRAILS_VERSION: The guardrail version to apply. -
AWS_REGION: The AWS region where the guardrail is deployed. -
AWS_ACCESS_KEY_ID: The AWS access key ID used to authenticate the request. -
AWS_SECRET_ACCESS_KEY: The AWS secret access key used to authenticate the request.
ai_gateway_policies:
- ref: aws-guardrails-mask-content
ai_gateway: !lookup {id: !env AI_GATEWAY_ID}
name: aws-guardrails-mask-content
display_name: Mask content instead of blocking it
type: ai-aws-guardrails
enabled: true
config:
guardrails_id: !env GUARDRAILS_ID
guardrails_version: !env GUARDRAILS_VERSION
aws_region: !env AWS_REGION
aws_access_key_id: !env AWS_ACCESS_KEY_ID
aws_secret_access_key: !env AWS_SECRET_ACCESS_KEY
allow_masking: true
global: falseMake sure to replace the following placeholders with your own values:
AI_GATEWAY_ID: Theidof your AI Gateway.
curl -X POST https://{region}.api.konghq.com/v1/ai-gateways/{AIGatewayId}/policies \
--header "accept: application/json" \
--header "Content-Type: application/json" \
--header "Authorization: Bearer $KONNECT_TOKEN" \
--data '
{
"name": "aws-guardrails-mask-content",
"display_name": "Mask content instead of blocking it",
"type": "ai-aws-guardrails",
"enabled": true,
"config": {
"guardrails_id": "'$GUARDRAILS_ID'",
"guardrails_version": "'$GUARDRAILS_VERSION'",
"aws_region": "'$AWS_REGION'",
"aws_access_key_id": "'$AWS_ACCESS_KEY_ID'",
"aws_secret_access_key": "'$AWS_SECRET_ACCESS_KEY'",
"allow_masking": true
},
"global": false
}
'Make sure to replace the following placeholders with your own values:
-
region: Geographic region where your Kong Konnect is hosted and operates. -
KONNECT_TOKEN: Your Personal Access Token (PAT) associated with your Konnect account. -
AIGatewayId: Theidof the AI Gateway.
See the Konnect AI Gateway API reference to learn about region-specific URLs and personal access tokens.
Prerequisite: Configure your Personal Access Token
terraform {
required_providers {
konnect = {
source = "kong/konnect"
}
}
}
provider "konnect" {
personal_access_token = "$KONNECT_TOKEN"
server_url = "https://us.api.konghq.com/"
}Add the following to your Terraform configuration:
resource "konnect_ai_gateway_policy" "my_policy" {
name = "aws-guardrails-mask-content"
display_name = "Mask content instead of blocking it"
type = "ai-aws-guardrails"
enabled = true
global = false
config = jsonencode({
guardrails_id = var.guardrails_id
guardrails_version = var.guardrails_version
aws_region = var.aws_region
aws_access_key_id = var.aws_access_key_id
aws_secret_access_key = var.aws_secret_access_key
allow_masking = true
})
gateway_id = konnect_ai_gateway.my_ai_gateway.id
}This example requires the following variables to be added to your manifest. You can specify values at runtime by setting TF_VAR_name=value.
variable "guardrails_id" {
type = string
}
variable "guardrails_version" {
type = string
}
variable "aws_region" {
type = string
}
variable "aws_access_key_id" {
type = string
}
variable "aws_secret_access_key" {
type = string
}ai_gateway_policies:
- ref: aws-guardrails-mask-content
ai_gateway: !lookup {id: !env AI_GATEWAY_ID}
name: aws-guardrails-mask-content
display_name: Mask content instead of blocking it
type: ai-aws-guardrails
enabled: true
config:
guardrails_id: !env GUARDRAILS_ID
guardrails_version: !env GUARDRAILS_VERSION
aws_region: !env AWS_REGION
aws_access_key_id: !env AWS_ACCESS_KEY_ID
aws_secret_access_key: !env AWS_SECRET_ACCESS_KEY
allow_masking: true
global: falseMake sure to replace the following placeholders with your own values:
AI_GATEWAY_ID: Theidof your AI Gateway.
curl -X POST https://{region}.api.konghq.com/v1/ai-gateways/{AIGatewayId}/policies \
--header "accept: application/json" \
--header "Content-Type: application/json" \
--header "Authorization: Bearer $KONNECT_TOKEN" \
--data '
{
"name": "aws-guardrails-mask-content",
"display_name": "Mask content instead of blocking it",
"type": "ai-aws-guardrails",
"enabled": true,
"config": {
"guardrails_id": "'$GUARDRAILS_ID'",
"guardrails_version": "'$GUARDRAILS_VERSION'",
"aws_region": "'$AWS_REGION'",
"aws_access_key_id": "'$AWS_ACCESS_KEY_ID'",
"aws_secret_access_key": "'$AWS_SECRET_ACCESS_KEY'",
"allow_masking": true
},
"global": false
}
'Make sure to replace the following placeholders with your own values:
-
region: Geographic region where your Kong Konnect is hosted and operates. -
KONNECT_TOKEN: Your Personal Access Token (PAT) associated with your Konnect account. -
AIGatewayId: Theidof the AI Gateway.
See the Konnect AI Gateway API reference to learn about region-specific URLs and personal access tokens.
Prerequisite: Configure your Personal Access Token
terraform {
required_providers {
konnect = {
source = "kong/konnect"
}
}
}
provider "konnect" {
personal_access_token = "$KONNECT_TOKEN"
server_url = "https://us.api.konghq.com/"
}Add the following to your Terraform configuration:
resource "konnect_ai_gateway_policy" "my_policy" {
name = "aws-guardrails-mask-content"
display_name = "Mask content instead of blocking it"
type = "ai-aws-guardrails"
enabled = true
global = false
config = jsonencode({
guardrails_id = var.guardrails_id
guardrails_version = var.guardrails_version
aws_region = var.aws_region
aws_access_key_id = var.aws_access_key_id
aws_secret_access_key = var.aws_secret_access_key
allow_masking = true
})
gateway_id = konnect_ai_gateway.my_ai_gateway.id
}This example requires the following variables to be added to your manifest. You can specify values at runtime by setting TF_VAR_name=value.
variable "guardrails_id" {
type = string
}
variable "guardrails_version" {
type = string
}
variable "aws_region" {
type = string
}
variable "aws_access_key_id" {
type = string
}
variable "aws_secret_access_key" {
type = string
}ai_gateway_policies:
- ref: aws-guardrails-mask-content
ai_gateway: !lookup {id: !env AI_GATEWAY_ID}
name: aws-guardrails-mask-content
display_name: Mask content instead of blocking it
type: ai-aws-guardrails
enabled: true
config:
guardrails_id: !env GUARDRAILS_ID
guardrails_version: !env GUARDRAILS_VERSION
aws_region: !env AWS_REGION
aws_access_key_id: !env AWS_ACCESS_KEY_ID
aws_secret_access_key: !env AWS_SECRET_ACCESS_KEY
allow_masking: true
global: falseMake sure to replace the following placeholders with your own values:
AI_GATEWAY_ID: Theidof your AI Gateway.
curl -X POST https://{region}.api.konghq.com/v1/ai-gateways/{AIGatewayId}/policies \
--header "accept: application/json" \
--header "Content-Type: application/json" \
--header "Authorization: Bearer $KONNECT_TOKEN" \
--data '
{
"name": "aws-guardrails-mask-content",
"display_name": "Mask content instead of blocking it",
"type": "ai-aws-guardrails",
"enabled": true,
"config": {
"guardrails_id": "'$GUARDRAILS_ID'",
"guardrails_version": "'$GUARDRAILS_VERSION'",
"aws_region": "'$AWS_REGION'",
"aws_access_key_id": "'$AWS_ACCESS_KEY_ID'",
"aws_secret_access_key": "'$AWS_SECRET_ACCESS_KEY'",
"allow_masking": true
},
"global": false
}
'Make sure to replace the following placeholders with your own values:
-
region: Geographic region where your Kong Konnect is hosted and operates. -
KONNECT_TOKEN: Your Personal Access Token (PAT) associated with your Konnect account. -
AIGatewayId: Theidof the AI Gateway.
See the Konnect AI Gateway API reference to learn about region-specific URLs and personal access tokens.
Prerequisite: Configure your Personal Access Token
terraform {
required_providers {
konnect = {
source = "kong/konnect"
}
}
}
provider "konnect" {
personal_access_token = "$KONNECT_TOKEN"
server_url = "https://us.api.konghq.com/"
}Add the following to your Terraform configuration:
resource "konnect_ai_gateway_policy" "my_policy" {
name = "aws-guardrails-mask-content"
display_name = "Mask content instead of blocking it"
type = "ai-aws-guardrails"
enabled = true
global = false
config = jsonencode({
guardrails_id = var.guardrails_id
guardrails_version = var.guardrails_version
aws_region = var.aws_region
aws_access_key_id = var.aws_access_key_id
aws_secret_access_key = var.aws_secret_access_key
allow_masking = true
})
gateway_id = konnect_ai_gateway.my_ai_gateway.id
}This example requires the following variables to be added to your manifest. You can specify values at runtime by setting TF_VAR_name=value.
variable "guardrails_id" {
type = string
}
variable "guardrails_version" {
type = string
}
variable "aws_region" {
type = string
}
variable "aws_access_key_id" {
type = string
}
variable "aws_secret_access_key" {
type = string
}ai_gateway_policies:
- ref: aws-guardrails-mask-content
ai_gateway: !lookup {id: !env AI_GATEWAY_ID}
name: aws-guardrails-mask-content
display_name: Mask content instead of blocking it
type: ai-aws-guardrails
enabled: true
config:
guardrails_id: !env GUARDRAILS_ID
guardrails_version: !env GUARDRAILS_VERSION
aws_region: !env AWS_REGION
aws_access_key_id: !env AWS_ACCESS_KEY_ID
aws_secret_access_key: !env AWS_SECRET_ACCESS_KEY
allow_masking: true
global: trueMake sure to replace the following placeholders with your own values:
AI_GATEWAY_ID: Theidof your AI Gateway.
curl -X POST https://{region}.api.konghq.com/v1/ai-gateways/{AIGatewayId}/policies \
--header "accept: application/json" \
--header "Content-Type: application/json" \
--header "Authorization: Bearer $KONNECT_TOKEN" \
--data '
{
"name": "aws-guardrails-mask-content",
"display_name": "Mask content instead of blocking it",
"type": "ai-aws-guardrails",
"enabled": true,
"config": {
"guardrails_id": "'$GUARDRAILS_ID'",
"guardrails_version": "'$GUARDRAILS_VERSION'",
"aws_region": "'$AWS_REGION'",
"aws_access_key_id": "'$AWS_ACCESS_KEY_ID'",
"aws_secret_access_key": "'$AWS_SECRET_ACCESS_KEY'",
"allow_masking": true
},
"global": true
}
'Make sure to replace the following placeholders with your own values:
-
region: Geographic region where your Kong Konnect is hosted and operates. -
KONNECT_TOKEN: Your Personal Access Token (PAT) associated with your Konnect account. -
AIGatewayId: Theidof the AI Gateway.
See the Konnect AI Gateway API reference to learn about region-specific URLs and personal access tokens.
Prerequisite: Configure your Personal Access Token
terraform {
required_providers {
konnect = {
source = "kong/konnect"
}
}
}
provider "konnect" {
personal_access_token = "$KONNECT_TOKEN"
server_url = "https://us.api.konghq.com/"
}Add the following to your Terraform configuration:
resource "konnect_ai_gateway_policy" "my_policy" {
name = "aws-guardrails-mask-content"
display_name = "Mask content instead of blocking it"
type = "ai-aws-guardrails"
enabled = true
global = true
config = jsonencode({
guardrails_id = var.guardrails_id
guardrails_version = var.guardrails_version
aws_region = var.aws_region
aws_access_key_id = var.aws_access_key_id
aws_secret_access_key = var.aws_secret_access_key
allow_masking = true
})
gateway_id = konnect_ai_gateway.my_ai_gateway.id
}This example requires the following variables to be added to your manifest. You can specify values at runtime by setting TF_VAR_name=value.
variable "guardrails_id" {
type = string
}
variable "guardrails_version" {
type = string
}
variable "aws_region" {
type = string
}
variable "aws_access_key_id" {
type = string
}
variable "aws_secret_access_key" {
type = string
}After creating the policy, add aws-guardrails-mask-content to the policies array of your AI Model. The tool examples update an existing AI Model with the policy attached: replace the entity configuration in the example with your own, as the update replaces the entire AI Model.
ai_gateway_models:
- ref: my-gpt-4o
ai_gateway: !lookup {id: !env AI_GATEWAY_ID}
display_name: my-gpt-4o
name: my-gpt-4o
type: model
capabilities:
- generate
formats:
- type: openai
targets:
- name: gpt-4o
provider: my-openai-account
config:
type: openai
config:
route:
paths:
- "/v1"
model:
body_param: model
values:
- my-gpt-4o
logging:
payloads: false
policies:
- !ref aws-guardrails-mask-content#nameAfter creating the policy, add aws-guardrails-mask-content to the policies array of your AI Model. The tool examples update an existing AI Model with the policy attached: replace the entity configuration in the example with your own, as the update replaces the entire AI Model.
curl -X PUT https://{region}.api.konghq.com/v1/ai-gateways/{AIGatewayId}/models/my-gpt-4o \
--header "accept: application/json" \
--header "Content-Type: application/json" \
--header "Authorization: Bearer $KONNECT_TOKEN" \
--data '
{
"display_name": "my-gpt-4o",
"name": "my-gpt-4o",
"type": "model",
"capabilities": [
"generate"
],
"formats": [
{
"type": "openai"
}
],
"policies": [
"aws-guardrails-mask-content"
],
"targets": [
{
"name": "gpt-4o",
"provider": "my-openai-account",
"config": {
"type": "openai"
}
}
],
"config": {
"route": {
"paths": [
"/v1"
],
"model": {
"body_param": "model",
"values": [
"my-gpt-4o"
]
}
},
"logging": {
"payloads": false
}
}
}
'After creating the policy, add aws-guardrails-mask-content to the policies array of your AI Model. The tool examples update an existing AI Model with the policy attached: replace the entity configuration in the example with your own, as the update replaces the entire AI Model.
resource "konnect_ai_gateway_model" "my_model" {
display_name = "my-gpt-4o"
name = "my-gpt-4o"
type = "model"
capabilities = ["generate"]
formats = [
{
type = "openai"
} ]
targets = [
{
name = "gpt-4o"
provider = "my-openai-account"
config = {
type = "openai"
}
} ]
config = jsonencode({
route = {
paths = ["/v1"]
model = {
body_param = "model"
values = ["my-gpt-4o"]
}
}
logging = {
payloads = false
}
})
policies = [konnect_ai_gateway_policy.my_policy.name]
gateway_id = konnect_ai_gateway.my_ai_gateway.id
}This example requires the following variables to be added to your manifest. You can specify values at runtime by setting TF_VAR_name=value.
variable "guardrails_id" {
type = string
}
variable "guardrails_version" {
type = string
}
variable "aws_region" {
type = string
}
variable "aws_access_key_id" {
type = string
}
variable "aws_secret_access_key" {
type = string
}After creating the policy, add aws-guardrails-mask-content to the policies array of your AI Consumer. The tool examples update an existing AI Consumer with the policy attached: replace the entity configuration in the example with your own, as the update replaces the entire AI Consumer.
ai_gateway_consumers:
- ref: mobile-app-production
ai_gateway: !lookup {id: !env AI_GATEWAY_ID}
display_name: Mobile App - Production
name: mobile-app-production
type: api-key
policies:
- !ref aws-guardrails-mask-content#nameAfter creating the policy, add aws-guardrails-mask-content to the policies array of your AI Consumer. The tool examples update an existing AI Consumer with the policy attached: replace the entity configuration in the example with your own, as the update replaces the entire AI Consumer.
curl -X PUT https://{region}.api.konghq.com/v1/ai-gateways/{AIGatewayId}/consumers/mobile-app-production \
--header "accept: application/json" \
--header "Content-Type: application/json" \
--header "Authorization: Bearer $KONNECT_TOKEN" \
--data '
{
"display_name": "Mobile App - Production",
"name": "mobile-app-production",
"type": "api-key",
"policies": [
"aws-guardrails-mask-content"
]
}
'After creating the policy, add aws-guardrails-mask-content to the policies array of your AI Consumer. The tool examples update an existing AI Consumer with the policy attached: replace the entity configuration in the example with your own, as the update replaces the entire AI Consumer.
resource "konnect_ai_gateway_consumer" "my_consumer" {
display_name = "Mobile App - Production"
name = "mobile-app-production"
type = "api-key"
policies = [konnect_ai_gateway_policy.my_policy.name]
gateway_id = konnect_ai_gateway.my_ai_gateway.id
}This example requires the following variables to be added to your manifest. You can specify values at runtime by setting TF_VAR_name=value.
variable "guardrails_id" {
type = string
}
variable "guardrails_version" {
type = string
}
variable "aws_region" {
type = string
}
variable "aws_access_key_id" {
type = string
}
variable "aws_secret_access_key" {
type = string
}After creating the policy, add aws-guardrails-mask-content to the policies array of your AI Consumer Group. The tool examples update an existing AI Consumer Group with the policy attached: replace the entity configuration in the example with your own, as the update replaces the entire AI Consumer Group.
ai_gateway_consumer_groups:
- ref: internal-teams
ai_gateway: !lookup {id: !env AI_GATEWAY_ID}
display_name: Internal Teams
name: internal-teams
policies:
- !ref aws-guardrails-mask-content#nameAfter creating the policy, add aws-guardrails-mask-content to the policies array of your AI Consumer Group. The tool examples update an existing AI Consumer Group with the policy attached: replace the entity configuration in the example with your own, as the update replaces the entire AI Consumer Group.
curl -X PUT https://{region}.api.konghq.com/v1/ai-gateways/{AIGatewayId}/consumer-groups/internal-teams \
--header "accept: application/json" \
--header "Content-Type: application/json" \
--header "Authorization: Bearer $KONNECT_TOKEN" \
--data '
{
"display_name": "Internal Teams",
"name": "internal-teams",
"policies": [
"aws-guardrails-mask-content"
]
}
'After creating the policy, add aws-guardrails-mask-content to the policies array of your AI Consumer Group. The tool examples update an existing AI Consumer Group with the policy attached: replace the entity configuration in the example with your own, as the update replaces the entire AI Consumer Group.
resource "konnect_ai_gateway_consumer_group" "my_consumer_group" {
display_name = "Internal Teams"
name = "internal-teams"
policies = [konnect_ai_gateway_policy.my_policy.name]
gateway_id = konnect_ai_gateway.my_ai_gateway.id
}This example requires the following variables to be added to your manifest. You can specify values at runtime by setting TF_VAR_name=value.
variable "guardrails_id" {
type = string
}
variable "guardrails_version" {
type = string
}
variable "aws_region" {
type = string
}
variable "aws_access_key_id" {
type = string
}
variable "aws_secret_access_key" {
type = string
}