{"record":{"id":"a536750c27c69d07","repo":"BerriAI/litellm","slug":"bedrock-guardrail-accepts-either-guardrailidentif","errorCode":null,"errorMessage":"Bedrock guardrail accepts either 'guardrailIdentifier'/'guardrailVersion' (ApplyGuardrail) or 'checks' (InvokeGuardrailChecks), not both.","messagePattern":"Bedrock guardrail accepts either 'guardrailIdentifier'/'guardrailVersion' \\(ApplyGuardrail\\) or 'checks' \\(InvokeGuardrailChecks\\), not both\\.","errorType":"validation","errorClass":"ValueError","httpStatus":null,"severity":"error","filePath":"litellm/proxy/guardrails/guardrail_hooks/bedrock_guardrails.py","lineNumber":252,"sourceCode":"        self.checks: dict[str, Any] | None = self._normalize_checks(checks)\n        # Per-check block thresholds; a score >= threshold blocks. None => the\n        # check is detect-only (logged, never blocks).\n        self.content_filter_threshold = content_filter_threshold\n        self.prompt_attack_threshold = prompt_attack_threshold\n        self.pii_confidence_threshold = pii_confidence_threshold\n\n        # store kwargs as optional_params\n        self.optional_params = kwargs\n\n        self.disable_exception_on_block: bool = disable_exception_on_block or False\n        \"\"\"\n        If True, will not raise an exception when the guardrail is blocked.\n        \"\"\"\n\n        # `checks` (InvokeGuardrailChecks) and `guardrailIdentifier`/`guardrailVersion`\n        # (ApplyGuardrail) are two different APIs; configuring both is ambiguous.\n        if self.checks is not None and (self.guardrailIdentifier is not None or self.guardrailVersion is not None):\n            raise ValueError(\n                \"Bedrock guardrail accepts either 'guardrailIdentifier'/'guardrailVersion' (ApplyGuardrail) \"\n                \"or 'checks' (InvokeGuardrailChecks), not both.\"\n            )\n\n        # Set supported event hooks to include MCP hooks\n        kwargs.setdefault(\"supported_event_hooks\", list(self.get_supported_event_hooks()))\n\n        super().__init__(**kwargs)\n        BaseAWSLLM.__init__(self)\n\n        # InvokeGuardrailChecks is detect-only: it never returns rewritten content,\n        # so masking has no effect in checks mode.\n        if self.checks is not None and (\n            getattr(self, \"mask_request_content\", False) or getattr(self, \"mask_response_content\", False)\n        ):\n            verbose_proxy_logger.warning(\n                \"Bedrock Guardrail: mask_request_content/mask_response_content have no \"\n                \"effect with 'checks' (InvokeGuardrailChecks is detect-only).\"","sourceCodeStart":234,"sourceCodeEnd":270,"githubUrl":"https://github.com/BerriAI/litellm/blob/77b7c6c40c0c5aa5fbcb1d6a1825ac39ca8829b8/litellm/proxy/guardrails/guardrail_hooks/bedrock_guardrails.py#L234-L270","documentation":"Init validation for the Bedrock guardrail: both ApplyGuardrail-style identifiers (guardrailIdentifier/guardrailVersion) and InvokeGuardrailChecks-style 'checks' were supplied; exactly one mode is allowed because they map to different Bedrock APIs.","triggerScenarios":"Thrown at litellm/proxy/guardrails/guardrail_hooks/bedrock_guardrails.py:252 when the library encounters an invalid state.","commonSituations":"Bedrock guardrail config mixes ApplyGuardrail and InvokeGuardrailChecks modes.","solutions":["Configure either guardrailIdentifier/guardrailVersion (ApplyGuardrail) or checks (InvokeGuardrailChecks), not both."],"exampleFix":"Remove the checks block when guardrailIdentifier is set.","handlingStrategy":"validation","validationCode":null,"typeGuard":null,"tryCatchPattern":null,"preventionTips":[],"tags":[],"backgroundTag":null,"analyzedSha":"77b7c6c40c0c5aa5fbcb1d6a1825ac39ca8829b8","analyzedAt":"2026-08-18T11:44:31.656Z","contentChangedAt":null,"schemaVersion":2},"datasetVersion":"2026-09-14T05:17:10.506Z"}