{
  "typeName" : "AWS::Bedrock::EnforcedGuardrailConfiguration",
  "description" : "Definition of AWS::Bedrock::EnforcedGuardrailConfiguration Resource Type",
  "definitions" : {
    "SelectiveContentGuarding" : {
      "type" : "object",
      "description" : "Selective content guarding controls for enforced guardrails",
      "additionalProperties" : false,
      "properties" : {
        "System" : {
          "type" : "string",
          "description" : "Selective guarding mode for system prompts",
          "enum" : [ "SELECTIVE", "COMPREHENSIVE" ]
        },
        "Messages" : {
          "type" : "string",
          "description" : "Selective guarding mode for user messages",
          "enum" : [ "SELECTIVE", "COMPREHENSIVE" ]
        }
      }
    },
    "ConfigOwner" : {
      "type" : "string",
      "description" : "Configuration owner type",
      "enum" : [ "ACCOUNT" ]
    },
    "ModelEnforcement" : {
      "type" : "object",
      "description" : "Model-specific information for the enforced guardrail configuration. If not present, the configuration is enforced on all models",
      "properties" : {
        "IncludedModels" : {
          "type" : "array",
          "description" : "Models to enforce the guardrail on",
          "minItems" : 1,
          "items" : {
            "type" : "string",
            "pattern" : "^(ALL|([a-z0-9-]{1,63}[.]{1}[a-z0-9-]{1,63})([:][a-z0-9-]{1,63}){0,2}(/[a-z0-9]{12}){0,1})$",
            "description" : "Model identifier or ALL"
          }
        },
        "ExcludedModels" : {
          "type" : "array",
          "description" : "Models to exclude from enforcement. If a model is in both lists, it is excluded",
          "minItems" : 0,
          "items" : {
            "type" : "string",
            "pattern" : "^([a-z0-9-]{1,63}[.]{1}[a-z0-9-]{1,63})([:][a-z0-9-]{1,63}){0,2}(/[a-z0-9]{12}){0,1}$",
            "description" : "Model identifier to exclude"
          }
        }
      },
      "required" : [ "IncludedModels", "ExcludedModels" ],
      "additionalProperties" : false
    }
  },
  "properties" : {
    "ConfigId" : {
      "type" : "string",
      "pattern" : "^[a-z0-9]+$",
      "description" : "Unique ID for the account enforced configuration"
    },
    "GuardrailIdentifier" : {
      "type" : "string",
      "minLength" : 0,
      "maxLength" : 2048,
      "pattern" : "^(([a-z0-9]+)|(arn:aws(-[^:]+)?:bedrock:[a-z0-9-]{1,20}:[0-9]{12}:guardrail/[a-z0-9]+))$",
      "description" : "Identifier for the guardrail, could be the ID or the ARN"
    },
    "GuardrailVersion" : {
      "type" : "string",
      "pattern" : "^[1-9][0-9]{0,7}$",
      "description" : "Numerical guardrail version (not DRAFT)"
    },
    "SelectiveContentGuarding" : {
      "$ref" : "#/definitions/SelectiveContentGuarding"
    },
    "ModelEnforcement" : {
      "$ref" : "#/definitions/ModelEnforcement"
    },
    "GuardrailArn" : {
      "type" : "string",
      "minLength" : 0,
      "maxLength" : 2048,
      "pattern" : "^arn:aws(-[^:]+)?:bedrock:[a-z0-9-]{1,20}:[0-9]{12}:guardrail/[a-z0-9]+$",
      "description" : "ARN representation for the guardrail"
    },
    "GuardrailId" : {
      "type" : "string",
      "minLength" : 0,
      "maxLength" : 64,
      "pattern" : "^[a-z0-9]+$",
      "description" : "Unique ID for the guardrail"
    },
    "CreatedAt" : {
      "type" : "string",
      "description" : "Timestamp when the configuration was created",
      "format" : "date-time"
    },
    "CreatedBy" : {
      "type" : "string",
      "description" : "The ARN of the role used to create the configuration"
    },
    "UpdatedAt" : {
      "type" : "string",
      "description" : "Timestamp when the configuration was last updated",
      "format" : "date-time"
    },
    "UpdatedBy" : {
      "type" : "string",
      "description" : "The ARN of the role used to update the configuration"
    },
    "Owner" : {
      "$ref" : "#/definitions/ConfigOwner"
    }
  },
  "required" : [ "GuardrailIdentifier", "GuardrailVersion" ],
  "readOnlyProperties" : [ "/properties/ConfigId", "/properties/GuardrailArn", "/properties/GuardrailId", "/properties/CreatedAt", "/properties/CreatedBy", "/properties/UpdatedAt", "/properties/UpdatedBy", "/properties/Owner" ],
  "primaryIdentifier" : [ "/properties/ConfigId" ],
  "propertyTransform" : {
    "/properties/GuardrailIdentifier" : "$substringAfter(GuardrailIdentifier, \"/\") $OR GuardrailIdentifier"
  },
  "tagging" : {
    "taggable" : false
  },
  "handlers" : {
    "create" : {
      "permissions" : [ "bedrock:PutEnforcedGuardrailConfiguration", "bedrock:ListEnforcedGuardrailsConfiguration" ]
    },
    "read" : {
      "permissions" : [ "bedrock:ListEnforcedGuardrailsConfiguration" ]
    },
    "update" : {
      "permissions" : [ "bedrock:PutEnforcedGuardrailConfiguration", "bedrock:ListEnforcedGuardrailsConfiguration" ]
    },
    "delete" : {
      "permissions" : [ "bedrock:DeleteEnforcedGuardrailConfiguration" ]
    },
    "list" : {
      "permissions" : [ "bedrock:ListEnforcedGuardrailsConfiguration" ]
    }
  },
  "additionalProperties" : false
}