# Amazon Bedrock Guardrails vs ShieldGemma (slim)

> Amazon Bedrock Guardrails scores 77.4 (BB) to ShieldGemma's 54 (C) for content moderation. Prices, MCP, x402, uptime and agent notes side by side.

- Full: https://www.anchorterminal.com/compare/amazon-bedrock-guardrails-vs-shieldgemma.md (~6,100 tokens) · this version ~3,780 tokens · JSON https://www.anchorterminal.com/compare/amazon-bedrock-guardrails-vs-shieldgemma.json · canonical https://www.anchorterminal.com/compare/amazon-bedrock-guardrails-vs-shieldgemma
- Index: https://www.anchorterminal.com/llms.txt · API: https://www.anchorterminal.com/api/v1/index.json · MCP: https://www.anchorterminal.com/mcp · Updated: 2026-11-07
- Licence: CC BY 4.0, credit Anchor Terminal and link this page (https://www.anchorterminal.com/terms/#data)

Amazon Bedrock Guardrails scores 77.4 (BB) on agent readiness against ShieldGemma's 54 (C), and leads in 6 of 7 scored categories. ShieldGemma leads on payments & pricing. Both do content moderation.

- Amazon Bedrock Guardrails: BB 77.4, rank #29 of 1510 · https://www.anchorterminal.com/tools/amazon-bedrock-guardrails.min.md
- ShieldGemma: C 54, rank #927 of 1510 · https://www.anchorterminal.com/tools/shieldgemma.min.md
- Amazon Bedrock Guardrails, good for A team already on AWS that wants one versioned policy covering topics, PII masking, grounding and prompt attacks in front of any model. Ahead on Reliability, 75 against 46; Schema & documentation, 92 against 56; Agent ergonomics, 93 against 72; Security & auth, 96 against 53; Maintenance & community, 65 against 40; Transparency & trust, 70 against 54. Also Agent-ready, a grade of BB or better; A hosted endpoint, with nothing to install; Free to start without a card.
- ShieldGemma, good for Policy-specific content moderation of English text input or output, or of images, on the owner's hardware, with a probability to threshold. Ahead on Payments & pricing, 52 against 30. Also No key needed to call it.

| Category | Amazon Bedrock Guardrails | ShieldGemma |
| --- | --- | --- |
| Reliability (16%) | 75 | 46 |
| Performance (10%) | pending | pending |
| Schema & documentation (13%) | 92 | 56 |
| Agent ergonomics (13%) | 93 | 72 |
| Security & auth (14%) | 96 | 53 |
| Payments & pricing (10%) | 30 | 52 |
| Task success (10%) | pending | pending |
| Maintenance & community (7%) | 65 | 40 |
| Transparency & trust (7%) | 70 | 54 |

| Fact (where they differ) | Amazon Bedrock Guardrails | ShieldGemma |
| --- | --- | --- |
| Kind | HTTP API | Model API |
| Vendor | Amazon Web Services | Google DeepMind |
| Hosted endpoint | `https://bedrock-runtime.{region}.amazonaws.com/guardrail/{id}/version/{version}/apply` | no (local only) |
| Transports | HTTP |  |
| Auth | API key | None |
| Pricing | Pay per use | Free |
| Licence | none | Gemma Terms of Use (last modified 1 April 2026) with the Gemma Prohibited Use Policy. Not an OSI licence |
| Last release | 2026-10-20 | 2025-04-04 |
| Terms last updated | 2026-10-01 | 2026-04-01 |
| Privacy policy last updated | 2026-05-18 | no document linked |
| Customer content may train models | yes, with an opt-out | yes |
| Terms restrict automated access | yes | not found in the text |
| Terms restrict benchmarking | yes | not found in the text |
| Terms or service can change without notice | yes | not found in the text |
| Popularity | 21.1M npm/wk | none |
| Agent reviews | 3.4/5 (8) | none |

Why the edge:
- Security & auth, Amazon Bedrock Guardrails +43: Amazon Bedrock Guardrails 96 (IAM with SigV4, roles and short-lived credentials, and policies can name a single guardrail ARN (30). bedrock:ApplyGuardrail can be granted alone, the check calls change nothing, and creating or deleting a guardrail is a separate control-plane permission (20). The service is an injection detector, with a prompt-attack filter for jailbreaks and injection and prompt-leakage detection on the Standard tier (15). ApplyGuardrail calls are CloudTrail data events on the AWS::Bedrock::Guardrail resource type, but the CloudTrail page, re-read on 17 October, still doesn't mention InvokeGuardrailChecks (13 of 15). A vulnerability disclosure programme on HackerOne with a policy at vdp.aws.security, public security bulletins, and Amazon Bedrock in SOC scope on AWS's list updated 11 August 2026 (Bedrock Marketplace excluded). The aws.amazon.com security.txt expires on 16 October 2027 (re-read on 1 November), but the VDP names no paid bounty, so the 2 points stay held back, as on the Secrets Manager, SES and Polly re-checks of 17 October (18 of 20). No item in AWS's security bulletin feed, read on 1 November (39 items, the newest 30 October), names Guardrails.); ShieldGemma 53 (Read as a model the owner runs, on the model lines used for Granite Guardian, with retention and training in place of the read-only line. No key is needed to run it. Google's files need a Hugging Face login and licence acceptance, approved immediately, so there is a token to download but no secret at run time (13 of 30). Self-hosted, so inputs stay on the owner's hardware and nothing reaches Google, though no Google page says so (15 of 20). It reads untrusted text by design. The card says the model is highly sensitive to the policy wording and may behave unpredictably with ambiguous language, and gives no prompt-injection guidance (6 of 15). No call log of its own, though each call returns a score (5 of 15). Weights are safetensors only and load through Transformers classes with no remote code. Google's security.txt is valid and points to its reward programme, and there is no model-specific security page or advisory record (14 of 20). 13 + 15 + 6 + 5 + 14 = 53.)
- Schema & documentation, Amazon Bedrock Guardrails +36: Amazon Bedrock Guardrails 92 (The SDKs are generated from AWS's published service models, and the API reference gives every field with type, pattern and enum (25). The user guide has an llms.txt, re-read on 6 October with 67 lines naming guardrails, and serves .md pages (10). The guides explain when to call with source INPUT or OUTPUT, what each policy catches and the per-tier language limits, but say little about when a guardrail is the wrong tool (15 of 20). source and outputScope are enums, the guardrail id and version have patterns, and InvokeGuardrailChecks takes category enums (15). Request examples in the guides and seven typed errors with HTTP codes and troubleshooting links (15). Guardrails are versioned resources with a DRAFT and numbered versions, and there's a dated document history, and on 1 November it has a Guardrails entry of 19 October 2026 (Standard tier for contextual grounding), though it still has no entry for the Guardrails launches of April and June 2026 that What's New posted (12 of 15).); ShieldGemma 56 (Read for a model the owner serves. There is no specification of its own. The contract is the prompt pattern in the card, the chat template in the tokeniser config (ShieldGemma 1 takes the policy as a `guideline` argument) and a Yes or No token, with the HTTP route supplied by the serving stack (8 of 25). gemma.ai/llms.txt lists the ShieldGemma page and both cards, each served as Markdown (10 of 10). The cards state the intended use as an input or output moderator, give the exact guideline text for each harm type in each mode, say the model runs in scoring mode, is English only and is highly sensitive to how a policy is worded (16 of 20). Fixed harm types and a binary answer, with the policy as free text (10 of 15). A Transformers snippet for each generation and a Keras notebook. No failure modes or error cases are documented (8 of 15). Two named generations with no changelog, and the ai.google.dev page is marked deprecated in favour of gemma.ai (4 of 15). 8 + 10 + 16 + 10 + 8 + 4 = 56.)
- Reliability, Amazon Bedrock Guardrails +29: Amazon Bedrock Guardrails 75 (AWS Health Dashboard with per-service, per-region history and RSS feeds (20). AWS's dashboard history file, re-read on 1 November, lists Amazon Bedrock in the Middle East (UAE) me-central-1 and Middle East (Bahrain) me-south-1 multi-service events, open since 1 and 2 March 2026 at disruption status. On 15 September 2026, inside the 90-day window, AWS said it can't restore resources and data hosted only in me-south-1 or in the mec1-az2 zone. No update to either event after 15 September and no new Bedrock event since 4 October (the newest event in the file is the API Gateway us-west-2 one of 30 October, which doesn't list Bedrock). The only Bedrock-specific entry is a model access revocation on 13 June 2026, outside the window, and the eu-south-2 packet-loss event of 4 October lists Bedrock AgentCore but not Bedrock. One major event, read as the S3, Secrets Manager and Polly re-checks read it (10). Quotas published per Region in the AWS General Reference, per the 17 October check, not re-read on 1 November, 100 ApplyGuardrail requests a second in nine main Regions and 25 elsewhere, text units a second per policy and tier, and 1,500 InvokeGuardrailChecks calls a minute (15). The InvokeGuardrailChecks guide, per the 17 October check, says to retry 429 and 503 with exponential backoff and 500 as is (15). The Bedrock SLA, last updated 4 October 2023 (per the 17 October check), promises 99.9 per cent a region but covers "the Amazon Bedrock APIs for models" and doesn't name Guardrails (5 of 10, our call). ApplyGuardrail and InvokeGuardrailChecks carry no preview label (10).); ShieldGemma 46 (Scored on the local-software lines, since the owner runs the model, the reading used for Llama Guard and Granite Guardian. Google's install line is `pip install -U transformers[accelerate]` with no versions, a Keras Colab notebook covers ShieldGemma 1, and Ollama's own library carries ShieldGemma 1. No Python version or memory figure is stated, and the publisher's files sit behind a login and licence click-through (12 of 20). No CI, tests or evaluation code for the models were found. The technical reports describe the evaluation and nothing reruns it (0 of 25). On the Hub, 8 of 23 threads on the 2B, 2 of 10 on the 9B, none of 8 on the 27B and 9 of 10 on ShieldGemma 2 are open, but every open thread we sampled has a reply from a Google account, the newest on 22 March 2026 (15 of 25). No changelog or version tags. The two generations are named and sit in their own repositories (4 of 15). Released with no preview label (15 of 15). 12 + 0 + 15 + 4 + 15 = 46.)
- Maintenance & community, Amazon Bedrock Guardrails +25: Amazon Bedrock Guardrails 65 (Read by the listing's own shapes in the bedrock and bedrock-runtime service models, as this run's amazon-s3 re-check read models/s3. The bedrock model changed on 20 October 2026, adding a Standard or Classic tier for contextual grounding checks and raising the regex filters a guardrail can hold from 10 to 30. The document history (19 October) and What's New (20 October) announced the Standard tier for contextual grounding, 12 days before 1 November (30, up from 10, cause product). In the 90 days from 3 August we found two dated Guardrails changes, the 20 October one and wider name patterns for Automated Reasoning policy definitions on 30 September, which the 17 October check didn't count. Other bedrock and bedrock-runtime changes in the window (31 July, 24 August, 4 September) touch no guardrail shape, so fewer than three (0). Public document history and What's New, and support through re:Post and AWS Support, but the history still misses the April and June 2026 launches (10 of 15). Current SDKs, boto3 1.43.123 on 30 October 2026 (per its release tag) and the @aws-sdk/client-bedrock-runtime client with 21,122,074 npm downloads in the week to 29 October (15). SDKs ship near-daily and support Python 3.10 and later (10). 30 + 0 + 10 + 15 + 10 = 65.); ShieldGemma 40 (Read as a model, on the lines used for Granite Guardian (recency 30, deprecation 12, churn 8, responsiveness 25, packages 15, health 10). The newest file change is ShieldGemma 2 on 4 April 2025, 19 months before the check, and ShieldGemma 1 last changed in September 2024 (0 of 30). No deprecation policy. Both generations stay downloadable, and the ai.google.dev page was marked deprecated with a pointer to gemma.ai without dates for the models (3 of 12). Two generations in 2024 and 2025, each in its own repository, none replaced in place (6 of 8). Google accounts (members of Google's Gemma organisations on the Hub) answered every thread we sampled on the 2B, 9B and ShieldGemma 2 pages, from August 2024 to 22 March 2026, but leave most threads open (16 of 25). Transformers, Keras and Ollama's library load it (12 of 15). No CI, and Ollama's library build was last updated 2 years ago (3 of 10). 0 + 3 + 6 + 16 + 12 + 3 = 40.)
- Payments & pricing, ShieldGemma +22: Amazon Bedrock Guardrails 30 (No x402, MPP or L402 (0). Per-policy prices per 1,000 text units published without a login, unchanged on 1 November (20). No Guardrails-specific free tier on the pricing page, but new AWS accounts get up to $200 in Free Tier credits and the Free Tier page lists Amazon Bedrock. The Free Tier FAQ says most new customers don't need a payment method, while AWS may still ask for one, so half, as on the S3, Secrets Manager and Polly re-checks (10). A person signs up in a browser and sets up IAM (0).); ShieldGemma 52 (Self-hosted rule. Nothing to buy from Google, and the Gemma Terms of Use allow commercial use at no charge (20). Free to run with no card (20). Google's own files need an account and a licence click-through on Hugging Face or Kaggle, approved immediately, so a person has to sign in once. Ollama's library copies of ShieldGemma 1 pull with no account, and ShieldGemma 2 has none (12 of 20). No payment protocol (0). No hosted ShieldGemma from Google or an inference provider was found. 20 + 20 + 12 + 0 = 52.)
- Agent ergonomics, Amazon Bedrock Guardrails +21: Amazon Bedrock Guardrails 93 (outputScope INTERVENTIONS keeps the response to what fired, FULL returns every assessment, and usage says how many text units each policy billed (25). The guardrail picks which policies run, and InvokeGuardrailChecks takes the checks inline per call (20). Typed exceptions with HTTP codes and a troubleshooting page for each, though a quota breach comes back as a 400 ServiceQuotaExceededException beside the 429 ThrottlingException (18 of 20). A check has no side effect beyond billing, and the docs say which errors to retry (20). Official SDKs in Python, JavaScript and the other AWS languages, but ApplyGuardrail needs a guardrail built in advance and every call needs SigV4 signing (10 of 15).); ShieldGemma 72 (Read as a classifier an agent calls. One forward pass gives a probability, so no generated text has to be parsed when the caller has the logits (24 of 25). The caller picks prompt-only or prompt-response wording and its own threshold, but each call checks one policy, so four harm types take four calls (14 of 20). The model has no error responses of its own, and through a text-only server such as Ollama's chat endpoint the caller reads the first word and loses the score (7 of 20). Calls are stateless and the score is deterministic for the same input, so a check can be repeated safely (17 of 20). One Transformers snippet or `ollama run shieldgemma`, and the 2B runs on small GPUs, but the publisher's files need an account and the prompt pattern has to be copied from the card (10 of 15). 24 + 14 + 7 + 17 + 10 = 72.)