Research-backed calculator guide
Amazon Bedrock Guardrails Cost: Policy Meters, Blocked Prompts and Double Evaluation
Calculate Amazon Bedrock Guardrails cost per request by text units, enabled policies, blocked branches, and model-inference charges.
Amazon Bedrock Guardrails is not one flat per-request fee. The charge depends on which safeguard policies are enabled, how many 1,000-character text units are evaluated, whether the input is blocked before model inference, and whether the output is evaluated after the model has already generated it. The safest budget is therefore a request ledger, not a single “Guardrails percentage.”
Quick answer
For a text request, calculate Guardrails cost in four steps:
- Round the input and output text separately to billed text units. One text unit contains up to 1,000 characters, so 1,001 characters require two units.
- Count the distinct billable safeguard policies applied to that stage. Current AWS pricing lists content filters at $0.15 per 1,000 text units, denied topics at $0.15, sensitive-information filters at $0.10, contextual grounding checks at $0.10, and Automated Reasoning checks at $0.17. Word filters and regular-expression sensitive-information filters are listed as free. These are the US-dollar rates shown on the AWS Bedrock pricing page checked on 2026-11-02; verify the rate card before committing to a forecast. [1]
- Add input and output evaluation only when those stages actually run. A blocked input is charged for its Guardrails evaluation, but the foundation-model inference is not charged because the model call is discarded before it starts. [2]
- Keep model inference separate. A successful request pays for Guardrails plus the model’s input and output tokens. If the model generates a response and the output Guardrails check blocks it, you still pay for that model inference as well as the input and output Guardrails evaluations. [2]
A compact formula is:
Guardrails cost = Σ(policy rate × billed text units evaluated at each stage)
Then add the model charge for every request that actually reaches the foundation model. Do not multiply the Guardrails amount by a model token rate; these are separate meters.
What Amazon Bedrock Guardrails bills
A guardrail is a configuration containing one or more safeguards. AWS describes input evaluation followed by response evaluation for supported InvokeModel, streaming, Converse, and ConverseStream calls. The input can be stopped with a blocked message. If it passes, the model runs and its response can then be overridden or masked if the output evaluation intervenes. [2]
That sequence creates three useful accounting branches:
- Input blocked: count the input text units for each enabled billable policy. Do not count model inference, because the model was not called.
- Output blocked: count input and output Guardrails text units. Also count the foundation-model inference that produced the rejected response. A blocked response is not a free model attempt.
- Both pass: count input and output Guardrails text units plus the model inference for the returned response.
The policy count matters. If one 1,600-character input is checked by content filters, denied topics, and sensitive-information filters, it consumes two text units on each of three policy meters. It does not mean “two text units total.” AWS’s technical guidance calls this multiplicative consumption across distinct safeguards. Multiple categories inside the content-filter policy are not separately multiplied merely because several categories are enabled. [4]
The input and output lengths also matter independently. A 1,600-character prompt rounds to two units, while a 2,400-character response rounds to three. If you evaluate both, the request may consume five units per policy. This is why a request with a short prompt but long generated answer can cost more in output evaluation than in input evaluation.
For decoupled moderation, the ApplyGuardrail API lets you evaluate content without invoking a foundation model. The source field identifies whether the content is INPUT or OUTPUT; your application decides whether to continue, mask, or stop. That API can sit before retrieval, before a self-hosted model, or after a third-party model, but it does not make a model charge disappear when a model has already run. [5]
Current policy meters and exclusions
The following rates are the assumptions used in the examples below. They are vendor-published on-demand figures observed on 2026-11-02, not a quote for a particular account, region, contract, or tax treatment.
| Safeguard or meter | Assumed rate per 1,000 text units | How to include it | Important exclusion or note |
|---|---|---|---|
| Content filters | $0.15 | Count once for each input or output text-unit batch evaluated | Several content categories within this policy do not become several meters |
| Denied topics | $0.15 | Count each evaluated text unit when the policy is enabled | A separate policy meter from content filters |
| Sensitive-information filters | $0.10 | Count each evaluated text unit | Regular-expression filters are listed as free on the rate card |
| Contextual grounding checks | $0.10 | Count the combined source, query, and response text units where applicable | RAG context can make the evaluated payload much larger |
| Automated Reasoning checks | $0.17 | Count each evaluated text unit for the policy | Treat as a separate policy meter |
| Word filters | $0 | Exclude from the per-unit total | The filter itself is listed as free; other services can still incur charges |
These are Guardrails charges only. They exclude foundation-model input and output tokens, retrieval, vector database, network, logging, and application compute. If your request uses a Knowledge Base or an agent, model and retrieval work may create additional line items. For a broader workload view, compare the request ledger with the Model pricing comparison and the RAG, embedding and vector database cost calculator.
Worked cost example
Assume a production chat request has these characteristics:
- Input prompt: 1,600 characters.
- Generated response: 2,400 characters.
- Enabled billable policies: content filters, denied topics, and sensitive-information filters.
- Word filters are also enabled, but they are excluded from this per-unit total because AWS lists them as free.
- The model’s token price is intentionally not supplied. The purpose is to isolate the Guardrails ledger and then show where the model charge belongs.
- All figures are US dollars and use the AWS rates shown on 2026-11-02.
The input rounds to two text units and the output rounds to three. The content and denied-topic meters each cost $0.15 per 1,000 units; the sensitive-information meter costs $0.10.
| Request stage | Characters evaluated | Billed units | Content filters | Denied topics | Sensitive info | Guardrails subtotal | Model inference |
|---|---|---|---|---|---|---|---|
| Input blocked | 1,600 input | 2 | $0.00030 | $0.00030 | $0.00020 | $0.00080 | $0 because the model is not invoked |
| Output blocked | 1,600 input + 2,400 output | 2 + 3 | $0.00075 | $0.00075 | $0.00050 | $0.00200 | Add the model’s input/output inference charge |
| Both stages pass | 1,600 input + 2,400 output | 2 + 3 | $0.00075 | $0.00075 | $0.00050 | $0.00200 | Add the model’s input/output inference charge |
For the successful branch, the Guardrails arithmetic is:
(2 + 3) × $0.15 / 1,000 + (2 + 3) × $0.15 / 1,000 + (2 + 3) × $0.10 / 1,000 = $0.00200
For the input-blocked branch, the model never runs and only the two input units are charged:
2 × $0.15 / 1,000 + 2 × $0.15 / 1,000 + 2 × $0.10 / 1,000 = $0.00080
The important distinction is not that a blocked request has no cost. It has a Guardrails cost. The saving is the avoided model inference and any later retrieval or tool work that your application conditionally skips. Conversely, an output-blocked request has the same $0.00200 Guardrails subtotal in this example and still carries the model’s inference charge because generation already happened.
At 100,000 monthly requests, suppose 90,000 follow the passing branch and 10,000 are blocked at input. The Guardrails-only estimate is:
90,000 × $0.00200 + 10,000 × $0.00080 = $188 per month
That estimate assumes the same character lengths, three billable policies, no grounding payload, no image evaluations, and no rate changes. It is not a forecast of total Bedrock spend. To finish the estimate, add the actual model input and output token charges for the 90,000 successful requests, plus any requests that reached the model before an output intervention.
Why “double evaluation” changes the answer
A common undercount is to price only the user prompt. A normal guarded model call evaluates the input and then the response. If the response is 2,400 characters, its three rounded units are not covered by the two input units. The response check can therefore be the larger part of the Guardrails ledger for long answers, code, or RAG-generated text.
The effect is even more visible in streaming. AWS guidance notes that a 600-character streaming batch can still consume a full 1,000-character text unit. Repeated small batches can create more evaluation calls and partial-unit waste. Aligning evaluation batches with 1,000-character boundaries can reduce that rounding waste, subject to the safety and latency requirements of the application. [4] [5]
Do not blindly concatenate all conversation history into every evaluation either. Measure the actual payload passed to the API. A long source document used for a contextual grounding check may be part of the charged evaluated content, so the “user prompt length” alone can understate cost. If your system uses RAG, put the source, query, and generated answer into separate ledger fields so a change in retrieval chunk size is visible.
A useful operational ledger records request ID, guardrail ID and version, source (INPUT or OUTPUT), character count, rounded text units, enabled billable policies, intervention action, whether a model was invoked, and the model token usage. That data lets finance reconcile the estimate against AWS usage rather than guessing from request count.
Run your scenario
Turn this framework into an editable estimate.
Use dated, source-linked assumptions and see cost per request, successful task and month.
Common budgeting mistakes
Treating a guardrail as one policy. A guardrail can contain several policies, and each billable policy can create its own text-unit charge. Count policy types, not only guardrail IDs.
Charging model inference on every blocked input. The model charge is avoided only when the application stops before model invocation. A blocked result returned after a model already ran is not the same branch.
Ignoring output length. Response evaluation is part of the normal flow. Long answers and generated code can consume more units than prompts.
Using stale tutorial rates. The AWS Builder setup article is useful for integration shape, but it contains illustrative pricing that should not override the current AWS rate card. Use the dated vendor pricing page for a current estimate, then document the date and assumptions.
Calling a rounding estimate an invoice. AWS billing, region, tier, supported operation, discounts, taxes, and future rate changes can alter the final amount. Reconcile against Cost Explorer or billing exports after deployment.
FAQ
Does a blocked Bedrock prompt cost anything?
Yes. AWS documentation says the Guardrails evaluation is charged when an input prompt is blocked. The foundation-model inference call is not charged because the model is not invoked. In the worked example, the input-blocked Guardrails subtotal is $0.00080 under the stated lengths and three policy rates. [2]
Is a blocked model response free?
No. If the input passes, the model generates a response, and output Guardrails then blocks it, you pay for the Guardrails evaluation of both input and response and for the foundation-model inference that produced the response. The response may be discarded or replaced for the user, but generation has already consumed model resources. [2]
Are content-filter categories billed separately?
The AWS technical guidance describes consumption across distinct safeguards. Enabling several categories within the content-filter policy does not turn each category into a separate text-unit meter. A separate denied-topic or sensitive-information policy does add another policy meter. [4]
Does ApplyGuardrail include foundation-model pricing?
No. ApplyGuardrail evaluates content independently of a foundation model. It can be used before retrieval, with a self-hosted model, or after a third-party model. You pay for the configured Guardrails evaluation, while any model, retrieval, or application charges are separate. [5]
How should streaming output be budgeted?
Record every evaluated batch, not only the final response. A batch below 1,000 characters can still consume one text unit, so very small batches can increase effective cost. Batching near 1,000-character boundaries can reduce partial-unit waste, but do not sacrifice a safety boundary solely to optimize rounding. [4] [5]
Are word filters included in the per-request estimate?
AWS’s current rate card lists word filters and regular-expression sensitive-information filters as free. They still affect application behavior and may be combined with paid safeguards. Keep them in the configuration ledger even when their direct per-unit rate is zero, so a policy change is auditable. [1]
Limits and assumptions
This page uses the AWS US-dollar on-demand rates visible on 2026-11-02. It does not assume a free tier, negotiated discount, private pricing, tax treatment, cross-region transfer, image processing, Knowledge Base retrieval, agent orchestration, CloudWatch, or application hosting. It also treats character-based text-unit rounding as the planning model and does not substitute a tokenizer estimate for the Guardrails meter.
Pricing and product behavior can change. Before launch, confirm the current AWS rate card, the exact API operation, the policies enabled in the deployed guardrail version, and the character payload sent at each stage. Then compare the request ledger with actual usage and invoice data. For a full project-level estimate, combine this policy ledger with the AI agent development cost estimator and your model-specific token rates.
Primary sources checked
Pricing and product behavior can change. These sources support the time-sensitive claims in this guide; verify current provider terms before committing spend.