Cloud AI Guardrails Compared: Amazon Bedrock Guardrails, Azure Prompt Shields and Google Model Armor

All three major clouds now sell a managed guardrail service: an API that screens prompts and responses for attacks, harmful content and sensitive data. They are quick to adopt, especially for teams already on that cloud, and each has documented gaps that interviewers like to probe.

What they are

How they work

Bedrock Guardrails. You configure policies once and apply them in two ways: to Bedrock model calls, or to any text through the ApplyGuardrail API, which also works for models hosted elsewhere. Content filters have strength settings per category. The prompt attack category, which covers jailbreaks, prompt injection and prompt leakage, is available only in the Standard tier. AWS documents two important caveats. First, with InvokeModel you must wrap user input in guardrail input tags, or prompt attacks in those calls are not filtered. Second, the filter does not evaluate tool results or tool definitions. Automated Reasoning checks validate answers against a policy derived from your documents, but they only report findings, do not block, and offer no prompt injection protection.

Prompt Shields detect two kinds of attack: user prompt attacks (formerly "jailbreak risk detection") and document attacks, meaning instructions hidden in content the model reads. The REST call is text:shieldPrompt. It takes a userPrompt and up to five documents and returns attackDetected for each. Spotlighting, in preview, transforms document content so the model treats it as lower-trust data. Microsoft notes that Prompt Shields do not decide whether content is harmful, accurate or grounded, and are mainly trained on English.

Model Armor uses templates: sets of filters with confidence thresholds, ideally separate ones for inputs and outputs. Floor settings set minimum protections for an organisation, folder or project. Its API methods are SanitizeUserPrompt and SanitizeModelResponse. Integrations include Apigee, Google's agent and MCP infrastructure, and load balancers through Service Extensions, with findings sent to Security Command Center.

How to use it

Day one: call the API on both sides

With Bedrock, create a guardrail and a version, then check text from any source:

aws bedrock-runtime apply-guardrail \
    --guardrail-identifier <guardrail-id> --guardrail-version 1 \
    --source INPUT --content '[{"text": {"text": "user message here"}}]'

The response's action is GUARDRAIL_INTERVENED or NONE, with per-policy assessments. Use --source OUTPUT for model responses. The pattern is the same on the other clouds: screen the input and the retrieved documents, call the model, screen the output, then apply your own decision.

Week one: cover the content attackers actually control

Indirect injection arrives in documents, web pages, emails and tool results, not only in the user's message. Send retrieved documents through Prompt Shields' document analysis or your chosen equivalent. For Bedrock agents, remember that tool results are not covered by the prompt attack filter, and add your own checks or architecture controls there.

Every day: measure and log carefully

Run in detect or inspect-only mode first, measure false positives and misses on your own traffic, then enable blocking per feature. Be careful with logs: AWS notes that blocked content can appear in plain text in model invocation logs if those are enabled, so treat the logs as sensitive.

Where they stop

• Documented blind spots. Bedrock does not check tool results. Model Armor checks one turn at a time and does not decode encoded content. Prompt Shields do not judge harm or grounding.
• Detection is probabilistic. All three are classifiers with thresholds; adaptive attackers can find misses.
• Language and modality limits differ by service and filter.
• Lock-in and coverage. Mixing clouds and model providers means mixing guardrail behaviours; a gateway that applies one policy can help.

How it comes up in interviews

• "Our agent uses Bedrock Guardrails, so we're protected from prompt injection, right?" Tool results, input tagging and the limits of classifiers.
• "Where would you put Prompt Shields in a RAG pipeline?" On retrieved documents as well as the user prompt, before they reach the model.
• "Managed guardrails or open-source ones?" Speed, integration and support against portability, tuning and transparency.

Sources

Checked on 13 November 2026: Amazon Bedrock User Guide pages on guardrail components, prompt attacks, Automated Reasoning checks and the ApplyGuardrail API; Microsoft Learn pages on Prompt Shields and the Prompt Shields quickstart; Google Cloud documentation for the Model Armor overview and integrations.