Require Guidance to apply regex patterns AWS Bedrock guardrails

Question

Hello @**everyone**,

I'm currently working on implementing a regex pattern in **Amazon Bedrock Guardrails** to **block all email addresses except one specific email** — for example: `feeds[AT]domain.com`.

I’ve tried several patterns suggested by Amazon documentation and various AI models, including:
1. `^(?!feeds@domain\.com$)[a-zA-Z0-9._%+-]+@[a-zA-Z0-9.-]+\.[a-zA-Z]{2,}$`
2. `^(?!feeds@domain\.com$)([a-zA-Z0-9._%+-]+@[a-zA-Z0-9.-]+\.[a-zA-Z]{2,})$`
3. `^(feeds@domain\.com|[a-zA-Z0-9._%+-]+@(?!domain\.com)[a-zA-Z0-9.-]+\.[a-zA-Z]{2,})$`
4. and similar variations…

However, all of these seem to be invalid or unsupported, most likely due to **RE2 regex limitations** (e.g., no lookaheads).

👉 **Has anyone successfully implemented such a rule in Bedrock Guardrails, or found a workaround to allow only a specific email while blocking all others?**

Any guidance, workaround, or best practice would be greatly appreciated! 🙏

Thanks in advance!

#AmazonBedrock #BedrockGuardrails #Regex #Security #PromptEngineering #ContentFiltering #RegularExpressions

AWS-User-7634252 · Answer

Hi, can you provide more information on your desired functionality ? Are you trying to limit which email-addresses might show up in model's responses, but still want it to refer to feeds@domain.com when it's applicable ? Understanding your specific use case could help find an alternative solution. Also, curious which model you're testing this with.

Avinash Sharma · Answer

Hi @AWS-User-7634252, / OleksiiAndrosov

I'm looking to apply a specific restriction using Amazon Bedrock Guardrails to enhance the handling of PII within prompts.

The objective is to block all email addresses, with one exception — a designated help/support email such as feeds[at]domain.com. In essence:

If a prompt includes any email address, it should be denied.

The only allowed email address should be feeds[at]domain.com (as part of an approved support workflow).

All other PII-related information, especially unapproved email addresses, should be blocked by the guardrail.

I’ve explored a few regex patterns, but due to RE2 syntax limitations (such as unsupported lookaheads), I’ve not yet found a viable solution within the current Guardrails UI.

Require Guidance to apply regex patterns AWS Bedrock guardrails

Relevant content