awslabs / awslabs/agentcore-samples

06-workshops - [Bug] 07-Guardrails in Policy: SensitiveInformation Cedar syntax rejected by API — docs contradict runtime validation

Open
#2,036 0 comments 0 reactions 1 assignee Claimed by @akshseh View on GitHub
06-workshops bug
Dominant language
Python
Stars
3.4k
Forks
1.3k
Avg merge
1d 22h
Merged PRs (30d)
30

Description

**In which component is this bug present?**

- [ ] 01-AgentCore-runtime
- [x] 02-AgentCore-gateway
- [ ] 03-AgentCore-identity
- [ ] 04-AgentCore-memory
- [ ] 05-AgentCore-tools
- [ ] 06-AgentCore-observability
- [ ] 07-AgentCore-E2E

**Bug Description**

File: `deploy.py`, lines 509–533

Symptom:
```
botocore.errorfactory.ValidationException: An error occurred (ValidationException)
when calling the CreatePolicy operation: SensitiveInformation guardrail requires an
aggregation method call (e.g. count(), categories(), maxConfidenceScore(), minConfidenceScore()).
Per-category indexing is not supported for SensitiveInformation.
```

Root Cause: The deploy script uses per-category indexing syntax for SensitiveInformation policies. All attempted syntax variations are rejected:
- `["US_SOCIAL_SECURITY_NUMBER"].confidenceScore.greaterThanOrEqual(...)` — Rejected
- `.maxConfidenceScore().greaterThanOrEqual(decimal("0.5"))` — Rejected
- `.count() > 0` — Rejected
- `.categories().contains("US_SOCIAL_SECURITY_NUMBER")` — Rejected

**Documentation Conflict:** The official documentation shows an example using per-category indexing for SensitiveInformation, which contradicts the API's runtime validation. Either the docs are wrong or the API has a bug.

Impact: The `block_ssn` and `block_credit_cards` guardrail policies cannot be created. ContentFilter (VIOLENCE) and PromptAttack (JAILBREAK) work correctly.

**Suggested Fix**
Determine the correct Cedar syntax for SensitiveInformation guardrails and update both `deploy.py` and the documentation. If SensitiveInformation is not yet supported via the CreatePolicy API, document that limitation.

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.