Securing Agents Against Prompt Injection in External Data Sources

[mcosicaws]

The Sample Agentic Cost Optimizer reads Amazon CloudWatch logs to analyze AWS Lambda function performance and memory usage. This creates a security challenge, since CloudWatch logs are untrusted external data that could contain malicious prompt injections.

For instance, if CloudWatch logs contained something like "IGNORE ALL PREVIOUS INSTRUCTIONS...", the agent should treat this as data to analyse, not as instructions to follow.

We're planning a multi-layered defence approach:

Amazon Bedrock Guardrails

• Prompt attack filter to detect jailbreaks, prompt injection, and prompt leakage
• Denied topics: Credentials, code execution, data exfiltration
• PII redaction: Email, phone, SSN, AWS keys

System Prompt Instructions

• Explicit instructions to treat CloudWatch logs as data, not instructions
• Clear examples of malicious patterns to ignore

We are trying to find the right balance without blocking agent's ability to reason about complex log content. For instance, providing a custom tool for CloudWatch log reads through a sanitisation layer (detect and remove injection patterns), or rely purely on guardrails.

We'd love to hear your inputs about:

• How do you protect agents reading external data (logs, documents, web content, APIs)?
• What's your experience with Bedrock Guardrails? Prompt attack filters, denied topics, PII redaction?
• Have you ever encountered prompt injection attacks in production?
• Guardrails vs prompt engineering vs input sanitisation - which approaches work best?
• Do you wrap external data sources in sanitisation layers?

Please share your security approaches, incidents you've handled, or strategies you're exploring!