Specifies an agent as a resource in a top-level template. Minimally, you must specify the following properties:.

- AgentName – Specify a name for the agent.
- AgentResourceRoleArn – Specify the Amazon Resource Name (ARN) of the service role with permissions to invoke API operations on the agent. For more information, see [Create a service role for Agents for Amazon Bedrock](https://docs.aws.amazon.com/bedrock/latest/userguide/agents-permissions.html) .
- FoundationModel – Specify the model ID of a foundation model to use when invoking the agent. For more information, see [Supported regions and models for Agents for Amazon Bedrock](https://docs.aws.amazon.com//bedrock/latest/userguide/agents-supported.html) .

For more information about using agents in Amazon Bedrock , see [Agents for Amazon Bedrock](https://docs.aws.amazon.com/bedrock/latest/userguide/agents.html) .

See the *Properties* section below for descriptions of both the required and optional properties.

CfnAgent

agentName

The action groups that belong to an agent.

actionGroups

agentCollaboration

agentCollaborators

The Amazon Resource Name (ARN) of the IAM role with permissions to invoke API operations on the agent.

agentResourceRoleArn

Specifies whether to automatically update the `DRAFT` version of the agent after making changes to the agent.

The `DRAFT` version can be continually iterated upon during internal development. By default, this value is `false` .

autoPrepare

The Amazon Resource Name (ARN) of the AWS  key that encrypts the agent.

customerEncryptionKeyArn

Contains custom orchestration configurations for the agent.

customOrchestration

description

The foundation model used for orchestration by the agent.

foundationModel

Details about the guardrail associated with the agent.

guardrailConfiguration

The number of seconds for which Amazon Bedrock keeps information about a user's conversation with the agent.

A user interaction remains active for the amount of time specified. If no conversation occurs during this time, the session expires and Amazon Bedrock deletes any data provided before the timeout.

idleSessionTtlInSeconds

Instructions that tell the agent what it should do and how it should interact with users.

instruction

The knowledge bases associated with the agent.

knowledgeBases

Contains memory configuration for the agent.

memoryConfiguration

Specifies the orchestration strategy for the agent.

orchestrationType

Contains configurations to override prompt templates in different parts of an agent sequence.

For more information, see [Advanced prompts](https://docs.aws.amazon.com/bedrock/latest/userguide/advanced-prompts.html) .

promptOverrideConfiguration

Specifies whether to delete the resource even if it's in use.

By default, this value is `false` .

skipResourceInUseCheckOnDelete

Metadata that you can assign to a resource as key-value pairs. For more information, see the following resources:.

- [Tag naming limits and requirements](https://docs.aws.amazon.com/tag-editor/latest/userguide/tagging.html#tag-conventions)
- [Tagging best practices](https://docs.aws.amazon.com/tag-editor/latest/userguide/tagging.html#tag-best-practices)

testAliasTags

Specifies an agent alias as a resource in a top-level template. Minimally, you must specify the following properties:.

- AgentAliasName – Specify a name for the alias.

For more information about creating aliases for an agent in Amazon Bedrock , see [Deploy an Amazon Bedrock agent](https://docs.aws.amazon.com/bedrock/latest/userguide/agents-deploy.html) .

See the *Properties* section below for descriptions of both the required and optional properties.

CfnAgentAlias

agentAliasName

agentId

The description of the alias of the agent.

Contains details about the routing configuration of the alias.

routingConfiguration

Specifies an inference profile as a resource in a top-level template.

Use the `ModelSource` field to specify the inference profile to copy into the resource. For more information about using inference profiles in Amazon Bedrock , see [Improve resilience with cross-region inference](https://docs.aws.amazon.com/bedrock/latest/userguide/cross-region-inference.html) .

See the *Properties* section below for descriptions of both the required and optional properties.

CfnApplicationInferenceProfile

inferenceProfileName

The description of the inference profile.

Contains configurations for the inference profile to copy as the resource.

modelSource

A list of tags associated with the inference profile.

Creates an Automated Reasoning policy for Amazon Bedrock Guardrails.

Automated Reasoning policies use mathematical techniques to detect hallucinations, suggest corrections, and highlight unstated assumptions in the responses of your GenAI application.

To create a policy, you upload a source document that describes the rules that you're encoding. Automated Reasoning extracts important concepts from the source document that will become variables in the policy and infers policy rules.

To learn more about creating Automated Reasoning policies, see [Minimize AI hallucinations and deliver up to 99% verification accuracy with Automated Reasoning checks: Now available](https://docs.aws.amazon.com/aws/minimize-ai-hallucinations-and-deliver-up-to-99-verification-accuracy-with-automated-reasoning-checks-now-available/) in the *AWS News Blog* .

CfnAutomatedReasoningPolicy

name

Specifies whether to force delete the automated reasoning policy even if it has active resources.

When false , Amazon Bedrock validates if all artifacts have been deleted (e.g. policy version, test case, test result) for a policy before deletion. When true , Amazon Bedrock will delete the policy and all its artifacts without validation. Default is false

forceDelete

The KMS key with which the Policy's assets will be encrypted at rest.

kmsKeyId

The complete policy definition generated by the build workflow, containing all rules, variables, and custom types extracted from the source documents.

policyDefinition

The tags associated with the Automated Reasoning policy.

Creates a new version of an existing Automated Reasoning policy.

This allows you to iterate on your policy rules while maintaining previous versions for rollback or comparison purposes.

CfnAutomatedReasoningPolicyVersion

The Amazon Resource Name (ARN) of the policy.

policyArn

The hash of the policy definition that was last updated.

lastUpdatedDefinitionHash

The tags associated with the Automated Reasoning policy version.

Details about a data automation blueprint.

CfnBlueprint

blueprintName

schema

type

Name-value pairs to include as an encryption context.

kmsEncryptionContext

Resource Type definition for AWS::Bedrock::DataAutomationLibrary.

CfnDataAutomationLibrary

libraryName

encryptionConfiguration

Description of the DataAutomationLibrary.

libraryDescription

CfnDataAutomationProject

projectName

Blueprints to apply to objects processed by the project.

customOutputConfiguration

The AWS  encryption context to use for encryption.

overrideConfiguration

projectDescription

Type of the DataAutomationProject - Sync or Async.

projectType

The project's standard output configuration.

standardOutputConfiguration

> Properties with `__Update requires: Replacement__` can result in the creation of a new data source and deletion of the old one.

This can happen if you also change the Name of the data source.

Specifies a data source as a resource in a top-level template. Minimally, you must specify the following properties:

- Name – Specify a name for the data source.
- KnowledgeBaseId – Specify the ID of the knowledge base for the data source to belong to.
- DataSourceConfiguration – Specify information about the Amazon S3 bucket containing the data source. The following sub-properties are required:

- Type – Specify the value `S3` .

For more information about setting up data sources in Amazon Bedrock , see [Set up a data source for your knowledge base](https://docs.aws.amazon.com/bedrock/latest/userguide/knowledge-base-ds.html) .

See the *Properties* section below for descriptions of both the required and optional properties.

CfnDataSource

The connection configuration for the data source.

dataSourceConfiguration

The unique identifier of the knowledge base to which the data source belongs.

knowledgeBaseId

The data deletion policy for the data source.

dataDeletionPolicy

Contains details about the configuration of the server-side encryption.

serverSideEncryptionConfiguration

Contains details about how to ingest the documents in the data source.

vectorIngestionConfiguration

Definition of AWS::Bedrock::EnforcedGuardrailConfiguration Resource Type.

CfnEnforcedGuardrailConfiguration

Identifier for the guardrail, could be the ID or the ARN.

guardrailIdentifier

guardrailVersion

Model-specific information for the enforced guardrail configuration.

If not present, the configuration is enforced on all models

modelEnforcement

Selective content guarding controls for enforced guardrails.

selectiveContentGuarding

Creates a prompt flow that you can use to send an input through various steps to yield an output.

You define a flow by configuring nodes, each of which corresponds to a step of the flow, and creating connections between the nodes to create paths to different outputs. You can define the flow in one of the following ways:

- Define a [FlowDefinition](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-bedrock-flow-flowdefinition.html) in the `Definition` property.
- Provide the definition in the `DefinitionString` property as a JSON-formatted string matching the [FlowDefinition](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-bedrock-flow-flowdefinition.html) property.
- Provide an Amazon S3 location in the `DefinitionS3Location` property that matches the [FlowDefinition](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-bedrock-flow-flowdefinition.html) .

If you use the `DefinitionString` or `DefinitionS3Location` property, you can use the `DefinitionSubstitutions` property to define key-value pairs to replace at runtime.

For more information, see [How it works](https://docs.aws.amazon.com/bedrock/latest/userguide/flows-how-it-works.html) and [Create a prompt flow in Amazon Bedrock](https://docs.aws.amazon.com/bedrock/latest/userguide/flows-create.html) in the Amazon Bedrock User Guide.

CfnFlow

The Amazon Resource Name (ARN) of the service role with permissions to create a flow.

For more information, see [Create a service row for flows](https://docs.aws.amazon.com/bedrock/latest/userguide/flows-permissions.html) in the Amazon Bedrock User Guide.

executionRoleArn

The Amazon Resource Name (ARN) of the KMS key that the flow is encrypted with.

The definition of the nodes and connections between the nodes in the flow.

definition

The Amazon S3 location of the flow definition.

definitionS3Location

The definition of the flow as a JSON-formatted string.

The string must match the format in [FlowDefinition](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-bedrock-flow-flowdefinition.html) .

definitionString

A map that specifies the mappings for placeholder variables in the prompt flow definition.

This enables the customer to inject values obtained at runtime. Variables can be template parameter names, resource logical IDs, resource attributes, or a variable in a key-value map. Only supported with the `DefinitionString` and `DefinitionS3Location` fields.

Substitutions must follow the syntax: `${key_name}` or `${variable_1,variable_2,...}` .

definitionSubstitutions

Creates an alias of a flow for deployment.

For more information, see [Deploy a flow in Amazon Bedrock](https://docs.aws.amazon.com/bedrock/latest/userguide/flows-deploy.html) in the Amazon Bedrock User Guide.

CfnFlowAlias

The Amazon Resource Name (ARN) of the alias.

flowArn

A list of configurations about the versions that the alias maps to.

Currently, you can only specify one.

The configuration that specifies how nodes in the flow are executed concurrently.

concurrencyConfiguration

Creates a version of the flow that you can deploy.

For more information, see [Deploy a flow in Amazon Bedrock](https://docs.aws.amazon.com/bedrock/latest/userguide/flows-deploy.html) in the Amazon Bedrock User Guide.

CfnFlowVersion

The Amazon Resource Name (ARN) of the flow that the version belongs to.

Creates a guardrail to detect and filter harmful content in your generative AI application.

Amazon Bedrock Guardrails provides the following safeguards (also known as policies) to detect and filter harmful content:

- *Content filters* - Detect and filter harmful text or image content in input prompts or model responses. Filtering is done based on detection of certain predefined harmful content categories: Hate, Insults, Sexual, Violence, Misconduct and Prompt Attack. You also can adjust the filter strength for each of these categories.
- *Denied topics* - Define a set of topics that are undesirable in the context of your application. The filter will help block them if detected in user queries or model responses.
- *Word filters* - Configure filters to help block undesirable words, phrases, and profanity (exact match). Such words can include offensive terms, competitor names, etc.
- *Sensitive information filters* - Configure filters to help block or mask sensitive information, such as personally identifiable information (PII), or custom regex in user inputs and model responses. Blocking or masking is done based on probabilistic detection of sensitive information in standard formats in entities such as SSN number, Date of Birth, address, etc. This also allows configuring regular expression based detection of patterns for identifiers.
- *Contextual grounding check* - Help detect and filter hallucinations in model responses based on grounding in a source and relevance to the user query.

For more information, see [How Amazon Bedrock Guardrails works](https://docs.aws.amazon.com/bedrock/latest/userguide/guardrails-how.html) .

CfnGuardrail

The message to return when the guardrail blocks a prompt.

blockedInputMessaging

The message to return when the guardrail blocks a model response.

blockedOutputsMessaging

Configuration settings for integrating Automated Reasoning policies with Amazon Bedrock Guardrails.

automatedReasoningPolicyConfig

The content filter policies to configure for the guardrail.

contentPolicyConfig

Contextual grounding policy config for a guardrail.

contextualGroundingPolicyConfig

The system-defined guardrail profile that you're using with your guardrail.

Guardrail profiles define the destination AWS Regions where guardrail inference requests can be automatically routed. Using guardrail profiles helps maintain guardrail performance and reliability when demand increases.

For more information, see the [Amazon Bedrock User Guide](https://docs.aws.amazon.com/bedrock/latest/userguide/guardrails-cross-region.html) .

crossRegionConfig

The ARN of the AWS  key that you use to encrypt the guardrail.

kmsKeyArn

The sensitive information policy to configure for the guardrail.

sensitiveInformationPolicyConfig

The tags that you want to attach to the guardrail.

The topic policies to configure for the guardrail.

topicPolicyConfig

The word policy you configure for the guardrail.

wordPolicyConfig

Creates a version of the guardrail.

Use this API to create a snapshot of the guardrail when you are satisfied with a configuration, or to compare the configuration with another version.

CfnGuardrailVersion

The unique identifier of the guardrail.

This can be an ID or the ARN.

Specifies an intelligent prompt router resource for Amazon Bedrock .

CfnIntelligentPromptRouter

The default model to use when the routing criteria is not met.

fallbackModel

A list of foundation models that the prompt router can route requests to.

At least one model must be specified.

models

The name of the prompt router.

The name must be unique within your AWS account in the current region.

promptRouterName

routingCriteria

An optional description of the prompt router to help identify its purpose.

An array of key-value pairs to apply to this resource as tags.

You can use tags to categorize and manage your AWS resources.

Specifies a knowledge base as a resource in a top-level template. Minimally, you must specify the following properties:.

- Name – Specify a name for the knowledge base.
- RoleArn – Specify the Amazon Resource Name (ARN) of the IAM role with permissions to invoke API operations on the knowledge base. For more information, see [Create a service role for Knowledge base for Amazon Bedrock](https://docs.aws.amazon.com/bedrock/latest/userguide/kb-permissions.html) .
- KnowledgeBaseConfiguration – Specify the embeddings configuration of the knowledge base. The following sub-properties are required:

- Type – Specify the value `VECTOR` .
- StorageConfiguration – Specify information about the vector store in which the data source is stored. The following sub-properties are required:

- Type – Specify the vector store service that you are using.

> Redis Enterprise Cloud vector stores are currently unsupported in CloudFormation .

For more information about using knowledge bases in Amazon Bedrock , see [Knowledge base for Amazon Bedrock](https://docs.aws.amazon.com/bedrock/latest/userguide/knowledge-base.html) .

See the *Properties* section below for descriptions of both the required and optional properties.

CfnKnowledgeBase

Contains details about the embeddings configuration of the knowledge base.

knowledgeBaseConfiguration

The Amazon Resource Name (ARN) of the IAM role with permissions to invoke API operations on the knowledge base.

roleArn

The description of the knowledge base associated with the inline agent.

Contains details about the storage configuration of the knowledge base.

storageConfiguration

Creates a prompt in your prompt library that you can add to a flow.

For more information, see [Prompt management in Amazon Bedrock](https://docs.aws.amazon.com/bedrock/latest/userguide/prompt-management.html) , [Create a prompt using Prompt management](https://docs.aws.amazon.com/bedrock/latest/userguide/prompt-management-create.html) and [Prompt flows in Amazon Bedrock](https://docs.aws.amazon.com/bedrock/latest/userguide/flows.html) in the Amazon Bedrock User Guide.

CfnPrompt

The Amazon Resource Name (ARN) of the KMS key that the prompt is encrypted with.

The name of the default variant for the prompt.

This value must match the `name` field in the relevant [PromptVariant](https://docs.aws.amazon.com/bedrock/latest/APIReference/API_agent_PromptVariant.html) object.

defaultVariant

A list of objects, each containing details about a variant of the prompt.

variants

Creates a static snapshot of your prompt that can be deployed to production.

For more information, see [Deploy prompts using Prompt management by creating versions](https://docs.aws.amazon.com/bedrock/latest/userguide/prompt-management-deploy.html) in the Amazon Bedrock User Guide.

CfnPromptVersion

The Amazon Resource Name (ARN) of the version of the prompt.

promptArn

A map of tags attached to the prompt version and their values.

Definition of AWS::Bedrock::ResourcePolicy Resource Type.

CfnResourcePolicy

The IAM policy document defining access permissions for the guardrail and guardrail profile resources.

policyDocument

The ARN of the Bedrock Guardrail or Guardrail Profile resource.

Amazon Bedrock

L1 Constructs20