Added bedrock guardails #2615
Added bedrock guardails #2615
Conversation
There was a problem hiding this comment.
Pull Request Overview
This PR adds a new table aws_bedrock_guardrail to the Steampipe AWS plugin, enabling users to query AWS Bedrock guardrail resources. The implementation provides both list and get functionality with proper region support and consistent column naming.
- Adds
aws_bedrock_guardrailtable with comprehensive guardrail information - Implements both list (via
ListGuardrails) and get (viaGetGuardrail) operations - Normalizes field naming differences between list and get API responses
Reviewed Changes
Copilot reviewed 3 out of 3 changed files in this pull request and generated 4 comments.
| File | Description |
|---|---|
| script.sh | Deployment script for local plugin development |
| aws/table_aws_bedrock_guardrail.go | New table implementation with list/get hydration functions |
| aws/plugin.go | Registers the new guardrail table in the plugin's table map |
Tip: Customize your code reviews with copilot-instructions.md. Create the file or learn how to get started.
Co-authored-by: Copilot <[email protected]>
Co-authored-by: Copilot <[email protected]>
Co-authored-by: Copilot <[email protected]>
There was a problem hiding this comment.
Hi @SatoriSec — I’ve left a few review comments. When you have a moment, please take a look.
Additionally, could you make the following updates?
- Add documentation for this table, consistent with the others.
- Add any missing columns, and ensure each column name exactly matches the API response.
- Add missing column descriptions (you can copy from the API documentation):
- Add
tagsandtags_srccolumns to the table.
If anything is unclear, please feel free to reach out—we’re happy to help.
Thanks!
| ) | ||
|
|
||
| // unified row used for both List and Get paths | ||
| type bedrockGuardrailRow struct { |
There was a problem hiding this comment.
Is the custom struct necessary here?
| GetMatrixItemFunc: SupportedRegionMatrix(AWS_BEDROCK_SERVICE_ID), | ||
| Columns: awsRegionalColumns([]*plugin.Column{ | ||
| // identifiers | ||
| {Name: "arn", Type: proto.ColumnType_STRING, Description: "ARN of the guardrail.", Transform: transform.FromField("Arn")}, |
There was a problem hiding this comment.
Could you please confirm whether we should include an explicit transform here (Transform: transform.FromField("Arn")), or if the plugin-level default (DefaultTransform: transform.FromCamel()) already covers this case?
Also, please review the other columns and let me know if any of them require an explicit transform.
| if svc == nil { | ||
| return nil, nil | ||
| } | ||
| if err != nil { | ||
| plugin.Logger(ctx).Error("aws_bedrock_guardrail.listBedrockGuardrails", "connection_error", err) | ||
| return nil, err | ||
| if err != nil { | ||
| plugin.Logger(ctx).Error("aws_bedrock_guardrail.listBedrockGuardrails", "connection_error", err) | ||
| return nil, err | ||
| } | ||
| if svc == nil { | ||
| return nil, err | ||
| } |
There was a problem hiding this comment.
Could you please remove the duplicated code block?
| row := bedrockGuardrailRow{ | ||
| Arn: str(s.Arn), | ||
| GuardrailId: str(s.Id), | ||
| Name: str(s.Name), | ||
| Description: str(s.Description), | ||
| Status: string(s.Status), | ||
| Version: str(s.Version), | ||
| CreatedAt: t(s.CreatedAt), | ||
| UpdatedAt: t(s.UpdatedAt), | ||
| } |
There was a problem hiding this comment.
I don’t think we need a custom struct—let’s stream the API response as-is. The Get API response includes more detail than the List response, so we should expose all top-level properties as table columns. For fields that are only available via Get, add per-column Hydrate functions. For reference, see the aws_bedrock_agent table.
| } | ||
| } | ||
|
|
||
| // LIST: map GuardrailSummary -> bedrockGuardrailRow (ensures Arn/Id are set) |
There was a problem hiding this comment.
| // LIST: map GuardrailSummary -> bedrockGuardrailRow (ensures Arn/Id are set) | |
| //// LIST FUNCTION |
| if svc == nil { | ||
| return nil, nil | ||
| } | ||
| if err != nil { | ||
| plugin.Logger(ctx).Error("aws_bedrock_guardrail.getBedrockGuardrail", "connection_error", err) | ||
| return nil, err | ||
| if err != nil { | ||
| plugin.Logger(ctx).Error("aws_bedrock_guardrail.getBedrockGuardrail", "connection_error", err) | ||
| return nil, err | ||
| } | ||
| if svc == nil { | ||
| return nil, nil | ||
| } |
There was a problem hiding this comment.
Could you please remove the duplicated code block?
| return nil, err | ||
| } | ||
|
|
||
| row := bedrockGuardrailRow{ |
There was a problem hiding this comment.
I don't think this is required anymore.
| return nil, err | ||
| } | ||
|
|
||
| p := bedrock.NewListGuardrailsPaginator(svc, &bedrock.ListGuardrailsInput{}) |
There was a problem hiding this comment.
Could you set the input parameter MaxResults to 1000 by default, and also honor a user-specified limit in the query parameters? For reference, see https://github.com/turbot/steampipe-plugin-aws/blob/main/aws/table_aws_appsync_api.go#L117-L135.
| {Name: "created_at", Type: proto.ColumnType_TIMESTAMP, Transform: transform.FromField("CreatedAt")}, | ||
| {Name: "updated_at", Type: proto.ColumnType_TIMESTAMP, Transform: transform.FromField("UpdatedAt")}, | ||
|
|
||
| // steampipe standard | ||
| {Name: "title", Type: proto.ColumnType_STRING, Transform: transform.FromField("Name")}, | ||
| {Name: "akas", Type: proto.ColumnType_JSON, Transform: transform.FromField("Arn").Transform(transform.EnsureStringArray)}, |
There was a problem hiding this comment.
Please add the missing description.
| Columns: awsRegionalColumns([]*plugin.Column{ | ||
| // identifiers | ||
| {Name: "arn", Type: proto.ColumnType_STRING, Description: "ARN of the guardrail.", Transform: transform.FromField("Arn")}, | ||
| {Name: "guardrail_id", Type: proto.ColumnType_STRING, Description: "ID of the guardrail.", Transform: transform.FromField("GuardrailId")}, |
There was a problem hiding this comment.
| {Name: "guardrail_id", Type: proto.ColumnType_STRING, Description: "ID of the guardrail.", Transform: transform.FromField("GuardrailId")}, | |
| {Name: "id", Type: proto.ColumnType_STRING, Description: "The unique identifier of the guardrail."}, |
misraved
added
the
community-contribution
|
Hello @SatoriSec, Just checking -- did you get any chance to take a look at the above comment? |
|
Been little busy. Yes, I will fix the code and submit again.
…On Thu, Sep 4, 2025 at 10:27 AM Keep Focused ***@***.***> wrote:
*ParthaI* left a comment (turbot/steampipe-plugin-aws#2615)
<#2615 (comment)>
Hello @SatoriSec <https://github.com/SatoriSec>, Just checking -- did you
get any chance to take a look at the above comment?
—
Reply to this email directly, view it on GitHub
<#2615 (comment)>,
or unsubscribe
<https://github.com/notifications/unsubscribe-auth/ACR3WBRHX2EINPXUFX3HL533RBK6TAVCNFSM6AAAAACEJJDQA6VHI2DSMVQWIX3LMV43OSLTON2WKQ3PNVWWK3TUHMZTENJUGIZTKNZRGI>
.
You are receiving this because you were mentioned.Message ID:
***@***.***>
|
3 participants
feat(bedrock): add aws_bedrock_guardrail table
Summary
Adds a new table:
aws_bedrock_guardrailListGuardrailsto return guardrail summaries (name, status, version, created/updated).GetGuardrailwhen queried byguardrail_idorarnto return full details.SupportedRegionMatrix(AWS_BEDROCK_SERVICE_ID)helper, consistent with other Bedrock tables.arn,guardrail_id,name,description,status,version,created_at,updated_at, plus standardtitle/akas.Arn/IdvsGuardrailArn/GuardrailId). The table normalizes both into a single row type soarn/guardrail_idreliably populate.Why: Guardrails are a core Bedrock resource; having them in Steampipe lets users inventory, audit status/versions, and drive workflows alongside other AWS assets.
IAM required:
bedrock:ListGuardrails,bedrock:GetGuardrail(optional:bedrock:ListTagsForResourceif tags are added later).Changes
aws/table_aws_bedrock_guardrail.go: new table implementation (list + get).plugin.go: registeraws_bedrock_guardrail.docs/tables/aws_bedrock_guardrail.md).Testing
Local build and queries using a dev install of the plugin (
~/.steampipe/plugins/local/aws/aws.plugin). Verified:arn/guardrail_id.GetGuardrailresolves when filtering byguardrail_idorarn.Integration test logs
Logs
Example query results
Results
Checklist
.inspect aws_bedrock_guardrail).arn/guardrail_id.guardrail_idorarn.Notes for reviewers
Arn/Idvs.GuardrailArn/GuardrailId) into a single row structure soarnandguardrail_idare always present.ListTagsForResource), additional policy fields fromGetGuardrail, and optional quals (e.g.,name,status).