HealthBridge (a healthcare app) will expose an LLM through Amazon Bedrock. Compliance requires blocking medical-diagnosis instructions, removing any personally identifiable information (PII) from model outputs, and logging violations. What is the appropriate Bedrock guardrail configuration and integration to meet these requirements?

The correct answer directly addresses all requirements. Bedrock Guardrails are designed to block specific topics (like medical diagnosis) and can be configured with custom policies for content filtering. Integrating Amazon Comprehend for PII detection in the response pipeline is the standard and most effective way to automatically redact sensitive information before it reaches the user. Logging to CloudWatch Logs and S3 ensures auditability of blocked content and redacted fields, meeting compliance needs. Prompt engineering alone is insufficient and unreliable for strict compliance. IAM SCPs are for access control, not content filtering, and AWS WAF is for web application security, not LLM response filtering. A Lambda scanning S3 for PII is reactive and doesn't prevent PII from being exposed initially. SageMaker Clarify is for model monitoring and explainability, not primarily for real-time PII redaction and content blocking for Bedrock models, and nightly batch jobs for redaction would expose PII temporarily.