AI GCP Model Armor: Log blocked request and response content - Policy

Log blocked request and response content

Configure the AI GCP Model Armor policy to log the raw content of blocked requests and responses. When a request or response is blocked, the original prompt or response body is captured in the log entry under ai.proxy.gcp-model-armor.input_faulty_prompt and ai.proxy.gcp-model-armor.output_faulty_response.

Prerequisites

A GCP project with Model Armor enabled and a configured template.
An existing AI Model.
An existing logging policy such as HTTP Log or File Log.

Environment variables

GCP_SERVICE_ACCOUNT_JSON: GCP service account credentials in JSON format.
GCP_PROJECT_ID: GCP project identifier.
GCP_LOCATION_ID: GCP location identifier.
GCP_TEMPLATE_ID: Guardrail template identifier.

Set up the policy

kongctl

policy.yaml

Copied!

ai_gateway_policies:
  - ref: gcp-model-armor-log-blocked-content
    ai_gateway: !lookup {id: !env AI_GATEWAY_ID}
    name: gcp-model-armor-log-blocked-content
    display_name: Log blocked request and response content
    type: ai-gcp-model-armor
    enabled: true
    config:
      project_id: !env GCP_PROJECT_ID
      location_id: !env GCP_LOCATION_ID
      template_id: !env GCP_TEMPLATE_ID
      gcp_use_service_account: true
      gcp_service_account_json: !env GCP_SERVICE_ACCOUNT_JSON
      log_blocked_content: true
    global: false

Make sure to replace the following placeholders with your own values:

AI_GATEWAY_ID: The id of your AI Gateway.
!env GCP_SERVICE_ACCOUNT_JSON: GCP service account credentials in JSON format.
!env GCP_PROJECT_ID: GCP project identifier.
!env GCP_LOCATION_ID: GCP location identifier.
!env GCP_TEMPLATE_ID: Guardrail template identifier.

curl -X POST https://{region}.api.konghq.com/v1/ai-gateways/{AIGatewayId}/policies \
    --header "accept: application/json" \
    --header "Content-Type: application/json" \
    --header "Authorization: Bearer $KONNECT_TOKEN" \
    --data '
    {
      "name": "gcp-model-armor-log-blocked-content",
      "display_name": "Log blocked request and response content",
      "type": "ai-gcp-model-armor",
      "enabled": true,
      "config": {
        "project_id": "'$GCP_PROJECT_ID'",
        "location_id": "'$GCP_LOCATION_ID'",
        "template_id": "'$GCP_TEMPLATE_ID'",
        "gcp_use_service_account": true,
        "gcp_service_account_json": "'$GCP_SERVICE_ACCOUNT_JSON'",
        "log_blocked_content": true
      },
      "global": false
    }
    '

Copied!

Make sure to replace the following placeholders with your own values:

region: Geographic region where your Kong Konnect is hosted and operates.
KONNECT_TOKEN: Your Personal Access Token (PAT) associated with your Konnect account.
AIGatewayId: The id of the AI Gateway.

See the Konnect AI Gateway API reference to learn about region-specific URLs and personal access tokens.

Prerequisite: Configure your Personal Access Token

terraform {
  required_providers {
    konnect = {
      source  = "kong/konnect"
    }
  }
}

provider "konnect" {
  personal_access_token = "$KONNECT_TOKEN"
  server_url            = "https://us.api.konghq.com/"
}

Copied!

Add the following to your Terraform configuration:

resource "konnect_ai_gateway_policy" "my_policy" {
  name = "gcp-model-armor-log-blocked-content"
  display_name = "Log blocked request and response content"
  type = "ai-gcp-model-armor"
  enabled = true
  global = false
  config = jsonencode({
    project_id = var.gcp_project_id
    location_id = var.gcp_location_id
    template_id = var.gcp_template_id
    gcp_use_service_account = true
    gcp_service_account_json = var.gcp_service_account_json
    log_blocked_content = true
  })


  gateway_id = konnect_ai_gateway.my_ai_gateway.id
}

Copied!

This example requires the following variables to be added to your manifest. You can specify values at runtime by setting TF_VAR_name=value.

variable "gcp_service_account_json" {
  type = string
}
variable "gcp_project_id" {
  type = string
}
variable "gcp_location_id" {
  type = string
}
variable "gcp_template_id" {
  type = string
}

Copied!

kongctl

policy.yaml

Copied!

ai_gateway_policies:
  - ref: gcp-model-armor-log-blocked-content
    ai_gateway: !lookup {id: !env AI_GATEWAY_ID}
    name: gcp-model-armor-log-blocked-content
    display_name: Log blocked request and response content
    type: ai-gcp-model-armor
    enabled: true
    config:
      project_id: !env GCP_PROJECT_ID
      location_id: !env GCP_LOCATION_ID
      template_id: !env GCP_TEMPLATE_ID
      gcp_use_service_account: true
      gcp_service_account_json: !env GCP_SERVICE_ACCOUNT_JSON
      log_blocked_content: true
    global: false

Make sure to replace the following placeholders with your own values:

AI_GATEWAY_ID: The id of your AI Gateway.
!env GCP_SERVICE_ACCOUNT_JSON: GCP service account credentials in JSON format.
!env GCP_PROJECT_ID: GCP project identifier.
!env GCP_LOCATION_ID: GCP location identifier.
!env GCP_TEMPLATE_ID: Guardrail template identifier.

curl -X POST https://{region}.api.konghq.com/v1/ai-gateways/{AIGatewayId}/policies \
    --header "accept: application/json" \
    --header "Content-Type: application/json" \
    --header "Authorization: Bearer $KONNECT_TOKEN" \
    --data '
    {
      "name": "gcp-model-armor-log-blocked-content",
      "display_name": "Log blocked request and response content",
      "type": "ai-gcp-model-armor",
      "enabled": true,
      "config": {
        "project_id": "'$GCP_PROJECT_ID'",
        "location_id": "'$GCP_LOCATION_ID'",
        "template_id": "'$GCP_TEMPLATE_ID'",
        "gcp_use_service_account": true,
        "gcp_service_account_json": "'$GCP_SERVICE_ACCOUNT_JSON'",
        "log_blocked_content": true
      },
      "global": false
    }
    '

Copied!

Make sure to replace the following placeholders with your own values:

region: Geographic region where your Kong Konnect is hosted and operates.
KONNECT_TOKEN: Your Personal Access Token (PAT) associated with your Konnect account.
AIGatewayId: The id of the AI Gateway.

See the Konnect AI Gateway API reference to learn about region-specific URLs and personal access tokens.

Prerequisite: Configure your Personal Access Token

terraform {
  required_providers {
    konnect = {
      source  = "kong/konnect"
    }
  }
}

provider "konnect" {
  personal_access_token = "$KONNECT_TOKEN"
  server_url            = "https://us.api.konghq.com/"
}

Copied!

Add the following to your Terraform configuration:

resource "konnect_ai_gateway_policy" "my_policy" {
  name = "gcp-model-armor-log-blocked-content"
  display_name = "Log blocked request and response content"
  type = "ai-gcp-model-armor"
  enabled = true
  global = false
  config = jsonencode({
    project_id = var.gcp_project_id
    location_id = var.gcp_location_id
    template_id = var.gcp_template_id
    gcp_use_service_account = true
    gcp_service_account_json = var.gcp_service_account_json
    log_blocked_content = true
  })


  gateway_id = konnect_ai_gateway.my_ai_gateway.id
}

Copied!

This example requires the following variables to be added to your manifest. You can specify values at runtime by setting TF_VAR_name=value.

variable "gcp_service_account_json" {
  type = string
}
variable "gcp_project_id" {
  type = string
}
variable "gcp_location_id" {
  type = string
}
variable "gcp_template_id" {
  type = string
}

Copied!

kongctl

policy.yaml

Copied!

ai_gateway_policies:
  - ref: gcp-model-armor-log-blocked-content
    ai_gateway: !lookup {id: !env AI_GATEWAY_ID}
    name: gcp-model-armor-log-blocked-content
    display_name: Log blocked request and response content
    type: ai-gcp-model-armor
    enabled: true
    config:
      project_id: !env GCP_PROJECT_ID
      location_id: !env GCP_LOCATION_ID
      template_id: !env GCP_TEMPLATE_ID
      gcp_use_service_account: true
      gcp_service_account_json: !env GCP_SERVICE_ACCOUNT_JSON
      log_blocked_content: true
    global: false

Make sure to replace the following placeholders with your own values:

AI_GATEWAY_ID: The id of your AI Gateway.
!env GCP_SERVICE_ACCOUNT_JSON: GCP service account credentials in JSON format.
!env GCP_PROJECT_ID: GCP project identifier.
!env GCP_LOCATION_ID: GCP location identifier.
!env GCP_TEMPLATE_ID: Guardrail template identifier.

curl -X POST https://{region}.api.konghq.com/v1/ai-gateways/{AIGatewayId}/policies \
    --header "accept: application/json" \
    --header "Content-Type: application/json" \
    --header "Authorization: Bearer $KONNECT_TOKEN" \
    --data '
    {
      "name": "gcp-model-armor-log-blocked-content",
      "display_name": "Log blocked request and response content",
      "type": "ai-gcp-model-armor",
      "enabled": true,
      "config": {
        "project_id": "'$GCP_PROJECT_ID'",
        "location_id": "'$GCP_LOCATION_ID'",
        "template_id": "'$GCP_TEMPLATE_ID'",
        "gcp_use_service_account": true,
        "gcp_service_account_json": "'$GCP_SERVICE_ACCOUNT_JSON'",
        "log_blocked_content": true
      },
      "global": false
    }
    '

Copied!

Make sure to replace the following placeholders with your own values:

region: Geographic region where your Kong Konnect is hosted and operates.
KONNECT_TOKEN: Your Personal Access Token (PAT) associated with your Konnect account.
AIGatewayId: The id of the AI Gateway.

See the Konnect AI Gateway API reference to learn about region-specific URLs and personal access tokens.

Prerequisite: Configure your Personal Access Token

terraform {
  required_providers {
    konnect = {
      source  = "kong/konnect"
    }
  }
}

provider "konnect" {
  personal_access_token = "$KONNECT_TOKEN"
  server_url            = "https://us.api.konghq.com/"
}

Copied!

Add the following to your Terraform configuration:

resource "konnect_ai_gateway_policy" "my_policy" {
  name = "gcp-model-armor-log-blocked-content"
  display_name = "Log blocked request and response content"
  type = "ai-gcp-model-armor"
  enabled = true
  global = false
  config = jsonencode({
    project_id = var.gcp_project_id
    location_id = var.gcp_location_id
    template_id = var.gcp_template_id
    gcp_use_service_account = true
    gcp_service_account_json = var.gcp_service_account_json
    log_blocked_content = true
  })


  gateway_id = konnect_ai_gateway.my_ai_gateway.id
}

Copied!

This example requires the following variables to be added to your manifest. You can specify values at runtime by setting TF_VAR_name=value.

variable "gcp_service_account_json" {
  type = string
}
variable "gcp_project_id" {
  type = string
}
variable "gcp_location_id" {
  type = string
}
variable "gcp_template_id" {
  type = string
}

Copied!

kongctl

policy.yaml

Copied!

ai_gateway_policies:
  - ref: gcp-model-armor-log-blocked-content
    ai_gateway: !lookup {id: !env AI_GATEWAY_ID}
    name: gcp-model-armor-log-blocked-content
    display_name: Log blocked request and response content
    type: ai-gcp-model-armor
    enabled: true
    config:
      project_id: !env GCP_PROJECT_ID
      location_id: !env GCP_LOCATION_ID
      template_id: !env GCP_TEMPLATE_ID
      gcp_use_service_account: true
      gcp_service_account_json: !env GCP_SERVICE_ACCOUNT_JSON
      log_blocked_content: true
    global: true

Make sure to replace the following placeholders with your own values:

AI_GATEWAY_ID: The id of your AI Gateway.
!env GCP_SERVICE_ACCOUNT_JSON: GCP service account credentials in JSON format.
!env GCP_PROJECT_ID: GCP project identifier.
!env GCP_LOCATION_ID: GCP location identifier.
!env GCP_TEMPLATE_ID: Guardrail template identifier.

curl -X POST https://{region}.api.konghq.com/v1/ai-gateways/{AIGatewayId}/policies \
    --header "accept: application/json" \
    --header "Content-Type: application/json" \
    --header "Authorization: Bearer $KONNECT_TOKEN" \
    --data '
    {
      "name": "gcp-model-armor-log-blocked-content",
      "display_name": "Log blocked request and response content",
      "type": "ai-gcp-model-armor",
      "enabled": true,
      "config": {
        "project_id": "'$GCP_PROJECT_ID'",
        "location_id": "'$GCP_LOCATION_ID'",
        "template_id": "'$GCP_TEMPLATE_ID'",
        "gcp_use_service_account": true,
        "gcp_service_account_json": "'$GCP_SERVICE_ACCOUNT_JSON'",
        "log_blocked_content": true
      },
      "global": true
    }
    '

Copied!

Make sure to replace the following placeholders with your own values:

region: Geographic region where your Kong Konnect is hosted and operates.
KONNECT_TOKEN: Your Personal Access Token (PAT) associated with your Konnect account.
AIGatewayId: The id of the AI Gateway.

See the Konnect AI Gateway API reference to learn about region-specific URLs and personal access tokens.

Prerequisite: Configure your Personal Access Token

terraform {
  required_providers {
    konnect = {
      source  = "kong/konnect"
    }
  }
}

provider "konnect" {
  personal_access_token = "$KONNECT_TOKEN"
  server_url            = "https://us.api.konghq.com/"
}

Copied!

Add the following to your Terraform configuration:

resource "konnect_ai_gateway_policy" "my_policy" {
  name = "gcp-model-armor-log-blocked-content"
  display_name = "Log blocked request and response content"
  type = "ai-gcp-model-armor"
  enabled = true
  global = true
  config = jsonencode({
    project_id = var.gcp_project_id
    location_id = var.gcp_location_id
    template_id = var.gcp_template_id
    gcp_use_service_account = true
    gcp_service_account_json = var.gcp_service_account_json
    log_blocked_content = true
  })


  gateway_id = konnect_ai_gateway.my_ai_gateway.id
}

Copied!

This example requires the following variables to be added to your manifest. You can specify values at runtime by setting TF_VAR_name=value.

variable "gcp_service_account_json" {
  type = string
}
variable "gcp_project_id" {
  type = string
}
variable "gcp_location_id" {
  type = string
}
variable "gcp_template_id" {
  type = string
}

Copied!

Attach the policy

After creating the policy, add gcp-model-armor-log-blocked-content to the policies array of your AI Model. The tool examples update an existing AI Model with the policy attached: replace the entity configuration in the example with your own, as the update replaces the entire AI Model.

kongctl

model.yaml

Copied!

ai_gateway_models:
  - ref: my-gpt-4o
    ai_gateway: !lookup {id: !env AI_GATEWAY_ID}
    display_name: my-gpt-4o
    name: my-gpt-4o
    type: model
    capabilities:
    - generate
    formats:
    - type: openai
    targets:
    - name: gpt-4o
      provider: my-openai-account
      config:
        type: openai
    config:
      route:
        paths:
        - "/v1"
        model:
          body_param: model
          values:
          - my-gpt-4o
      logging:
        payloads: false
    policies:
    - !ref gcp-model-armor-log-blocked-content#name

After creating the policy, add gcp-model-armor-log-blocked-content to the policies array of your AI Model. The tool examples update an existing AI Model with the policy attached: replace the entity configuration in the example with your own, as the update replaces the entire AI Model.

curl -X PUT https://{region}.api.konghq.com/v1/ai-gateways/{AIGatewayId}/models/my-gpt-4o \
    --header "accept: application/json" \
    --header "Content-Type: application/json" \
    --header "Authorization: Bearer $KONNECT_TOKEN" \
    --data '
    {
      "display_name": "my-gpt-4o",
      "name": "my-gpt-4o",
      "type": "model",
      "capabilities": [
        "generate"
      ],
      "formats": [
        {
          "type": "openai"
        }
      ],
      "policies": [
        "gcp-model-armor-log-blocked-content"
      ],
      "targets": [
        {
          "name": "gpt-4o",
          "provider": "my-openai-account",
          "config": {
            "type": "openai"
          }
        }
      ],
      "config": {
        "route": {
          "paths": [
            "/v1"
          ],
          "model": {
            "body_param": "model",
            "values": [
              "my-gpt-4o"
            ]
          }
        },
        "logging": {
          "payloads": false
        }
      }
    }
    '

Copied!

After creating the policy, add gcp-model-armor-log-blocked-content to the policies array of your AI Model. The tool examples update an existing AI Model with the policy attached: replace the entity configuration in the example with your own, as the update replaces the entire AI Model.

resource "konnect_ai_gateway_model" "my_model" {
  display_name = "my-gpt-4o"
  name = "my-gpt-4o"
  type = "model"
  capabilities = ["generate"]
  formats = [
    {
      type = "openai"
    }  ]
  targets = [
    {
      name = "gpt-4o"
      provider = "my-openai-account"

      config = {
        type = "openai"
      }
    }  ]
  config = jsonencode({

    route = {
      paths = ["/v1"]

      model = {
        body_param = "model"
        values = ["my-gpt-4o"]
      }
    }

    logging = {
      payloads = false
    }
  })
  policies = [konnect_ai_gateway_policy.my_policy.name]


  gateway_id = konnect_ai_gateway.my_ai_gateway.id
}

Copied!

This example requires the following variables to be added to your manifest. You can specify values at runtime by setting TF_VAR_name=value.

variable "gcp_service_account_json" {
  type = string
}
variable "gcp_project_id" {
  type = string
}
variable "gcp_location_id" {
  type = string
}
variable "gcp_template_id" {
  type = string
}

Copied!

After creating the policy, add gcp-model-armor-log-blocked-content to the policies array of your AI Consumer. The tool examples update an existing AI Consumer with the policy attached: replace the entity configuration in the example with your own, as the update replaces the entire AI Consumer.

kongctl

consumer.yaml

Copied!

ai_gateway_consumers:
  - ref: mobile-app-production
    ai_gateway: !lookup {id: !env AI_GATEWAY_ID}
    display_name: Mobile App - Production
    name: mobile-app-production
    type: api-key
    policies:
    - !ref gcp-model-armor-log-blocked-content#name

After creating the policy, add gcp-model-armor-log-blocked-content to the policies array of your AI Consumer. The tool examples update an existing AI Consumer with the policy attached: replace the entity configuration in the example with your own, as the update replaces the entire AI Consumer.

curl -X PUT https://{region}.api.konghq.com/v1/ai-gateways/{AIGatewayId}/consumers/mobile-app-production \
    --header "accept: application/json" \
    --header "Content-Type: application/json" \
    --header "Authorization: Bearer $KONNECT_TOKEN" \
    --data '
    {
      "display_name": "Mobile App - Production",
      "name": "mobile-app-production",
      "type": "api-key",
      "policies": [
        "gcp-model-armor-log-blocked-content"
      ]
    }
    '

Copied!

After creating the policy, add gcp-model-armor-log-blocked-content to the policies array of your AI Consumer. The tool examples update an existing AI Consumer with the policy attached: replace the entity configuration in the example with your own, as the update replaces the entire AI Consumer.

resource "konnect_ai_gateway_consumer" "my_consumer" {
  display_name = "Mobile App - Production"
  name = "mobile-app-production"
  type = "api-key"
  policies = [konnect_ai_gateway_policy.my_policy.name]


  gateway_id = konnect_ai_gateway.my_ai_gateway.id
}

Copied!

This example requires the following variables to be added to your manifest. You can specify values at runtime by setting TF_VAR_name=value.

variable "gcp_service_account_json" {
  type = string
}
variable "gcp_project_id" {
  type = string
}
variable "gcp_location_id" {
  type = string
}
variable "gcp_template_id" {
  type = string
}

Copied!

After creating the policy, add gcp-model-armor-log-blocked-content to the policies array of your AI Consumer Group. The tool examples update an existing AI Consumer Group with the policy attached: replace the entity configuration in the example with your own, as the update replaces the entire AI Consumer Group.

kongctl

consumer_group.yaml

Copied!

ai_gateway_consumer_groups:
  - ref: internal-teams
    ai_gateway: !lookup {id: !env AI_GATEWAY_ID}
    display_name: Internal Teams
    name: internal-teams
    policies:
    - !ref gcp-model-armor-log-blocked-content#name

After creating the policy, add gcp-model-armor-log-blocked-content to the policies array of your AI Consumer Group. The tool examples update an existing AI Consumer Group with the policy attached: replace the entity configuration in the example with your own, as the update replaces the entire AI Consumer Group.

curl -X PUT https://{region}.api.konghq.com/v1/ai-gateways/{AIGatewayId}/consumer-groups/internal-teams \
    --header "accept: application/json" \
    --header "Content-Type: application/json" \
    --header "Authorization: Bearer $KONNECT_TOKEN" \
    --data '
    {
      "display_name": "Internal Teams",
      "name": "internal-teams",
      "policies": [
        "gcp-model-armor-log-blocked-content"
      ]
    }
    '

Copied!

After creating the policy, add gcp-model-armor-log-blocked-content to the policies array of your AI Consumer Group. The tool examples update an existing AI Consumer Group with the policy attached: replace the entity configuration in the example with your own, as the update replaces the entire AI Consumer Group.

resource "konnect_ai_gateway_consumer_group" "my_consumer_group" {
  display_name = "Internal Teams"
  name = "internal-teams"
  policies = [konnect_ai_gateway_policy.my_policy.name]


  gateway_id = konnect_ai_gateway.my_ai_gateway.id
}

Copied!

This example requires the following variables to be added to your manifest. You can specify values at runtime by setting TF_VAR_name=value.

variable "gcp_service_account_json" {
  type = string
}
variable "gcp_project_id" {
  type = string
}
variable "gcp_location_id" {
  type = string
}
variable "gcp_template_id" {
  type = string
}

Copied!

AI GCP Model Armor Policy

Log blocked request and response content

Prerequisites

Environment variables

Set up the policy

Attach the policy

Help us make these docs great!

Still need help?