Sold by: Rose & Lotus
Deployed on AWS
Test your own GenAI endpoint with a fixed library of prompt-injection cases and get back a JSON record of exactly what was sent and what came back. Nothing leaves your AWS account.
The suite covers direct injection, jailbreak framing, encoding bypass, indirect injection through documents and retrieved content, and tool abuse. Two benign control cases check that the guardrail still answers ordinary questions. Runs as a scheduled ECS task, an EKS Job, or locally with Docker Compose.
Overview
Most guardrail vendors say they stop prompt injection. Very few buyers can check whether that is true on their own endpoint, with their own system prompt, this week.
Injection Attack Suite Runner is a batch container that runs a curated set of prompt-injection test cases against an endpoint you control, then writes down what happened. It speaks the OpenAI Chat Completions protocol, Amazon Bedrock through the Converse API, and any JSON REST service you can describe with a body template. The default suite is fifteen cases across six families: direct injection, jailbreak framing, encoding bypass, indirect injection, tool abuse, and benign controls. An extended pack takes that to about forty.
Leaks are proven rather than guessed at. Each run generates a fresh canary token, plants it in the test case's system prompt, and records it as a marker. If that token comes back in a response, the injection worked. There is no second model grading the output and no judgement call to argue with.
Two of the fifteen default cases are benign controls: ordinary staff questions that a correctly tuned guardrail has to answer. They are there because a guardrail that refuses everything scores a perfect block rate while quietly breaking production, and nothing else in a test suite catches that.
The tool records. It does not grade. Transcripts follow a published JSON schema and can be scored by Guardrail Effectiveness Scorer, by your own tooling, or by whatever you already use. Keeping the two jobs separate is what lets a report from one vendor's tester be checked by another vendor's scorer.
Everything runs in your account. There is no SaaS control plane, no telemetry and no callback. The container talks to the endpoint you configured and, if you ask it to, writes transcripts to your own S3 bucket. API keys are read from Secrets Manager, held in memory, and scrubbed from the transcript before it is written. We test that: a build fails if a planted credential shows up in the output.
Intended for endpoints you own or have written authorization to test. The tool does no scanning or discovery, is rate limited and concurrency capped out of the box, and does not mutate payloads against a live target looking for a way through. It runs a fixed, versioned, readable library, which is also what makes two runs comparable.
Highlights
- Fifteen severity-tagged test cases across six families, plus an extended pack of about forty. Every case is readable YAML you can inspect before you run it, and you can mount your own alongside them.
- Leaks are proven, not inferred. A fresh canary token is planted in each case and looked for in the reply, so a successful injection is a fact rather than an opinion. Credentials are scrubbed from the transcript, and a test in the build proves it.
- Runs as a scheduled ECS task, an EKS Job, or Docker Compose. Distroless and non-root, with exit codes for pipeline gates. Payload and response data stay in your VPC. No SaaS control plane, no telemetry.
Details
Sold by
Categories
Delivery method
Supported services
Delivery option
Docker container - run with Docker, ECS, or EKS
Latest version
Operating system
Linux
Deployed on AWS
New
Introducing multi-product solutions
You can now purchase comprehensive solutions tailored to use cases and industries.
Features and programs
Financing for AWS Marketplace purchases
AWS Marketplace now accepts line of credit payments through the PNC Vendor Finance program. This program is available to select AWS customers in the US, excluding NV, NC, ND, TN, & VT.
Pricing
Pricing is based on the duration and terms of your contract with the vendor. This entitles you to a specified quantity of use for the contract duration. If you choose not to renew or replace your contract before it ends, access to these entitlements will expire.
Additional AWS infrastructure costs may apply. Use the AWS Pricing Calculator to estimate your infrastructure costs.
Dimension | Description | Cost/12 months |
|---|---|---|
Growth | up to 50 test runs per month | Up to 50 runs per month against a single endpoint. Includes the fifteen case default suite, all three target adapters, and every deployment template. Email support with a two business day response. Suited to one team validating one assistant. | $800.00 |
Business | up to 500 test runs per month | Up to 500 runs per month across any number of endpoints. Adds the extended payload pack of about forty cases, custom payload directories, and S3 handoff to Guardrail Effectiveness Scorer. Email support with a one business day response. | $1,000.00 |
Enterprise | unlimited test runs | Unlimited runs across any number of endpoints and accounts. Adds private payload registries, multi target campaigns, cross run trend analysis and SIEM export. Named support contact, four business hour response, and a scheduled onboarding call. | $3,000.00 |
Dimensions summary
You choose from three contract tiers based on how many test runs you need per month. Growth caps you at 50 runs against a single endpoint. Business raises the limit to 500 runs across any number of endpoints and adds an extended payload pack and output handoff. Enterprise removes run limits across accounts and adds private payload registries, multi-target campaigns, trend analysis, and export features. Each step up widens run volume, endpoint scope, and included capabilities. Support also scales, moving from a two business day response toward a named contact with a four business hour response.
Top-of-mind questions for buyers
A test run executes the payload library against your configured target endpoint. Each run outputs structured transcripts for grading. Growth counts up to 50 runs monthly against one endpoint. Business and Enterprise count runs across multiple endpoints. The default suite includes fifteen payloads across six categories per run.
The contract dimensions include a fixed monthly run quota. Growth caps at 50 runs, Business at 500 runs, and Enterprise has no run limit. Phase 1 contracts require no metering integration, so runs above your quota are not billed per run. To raise your limit, move to a tier with a higher quota.
Each product is sold and deployed independently. You connect them through S3 or shared volumes using transcript schema v1.0. Business and Enterprise include S3 handoff to the scorer. The scorer requires its own separate subscription. Growth does not list the S3 handoff capability.
roselotusllc.com+1
Helpful?
Vendor refund policy
Contact support@roselotusllc.com within 30 days of your first subscription charge for a full refund of that charge. Include your AWS account ID and the reason. We process approved refunds through AWS Marketplace within 5 business days. Renewals after the first 30 days are not refundable, though you can cancel at any time to stop future charges.
Legal
Vendor terms and conditions
Upon subscribing to this product, you must acknowledge and agree to the terms and conditions outlined in the vendor's End User License Agreement (EULA) .
Content disclaimer
Vendors are responsible for their product descriptions and other product content. AWS does not warrant that vendors' product descriptions or other product content are accurate, complete, reliable, current, or error-free.
Delivery details
Docker container - run with Docker, ECS, or EKS
Supported services: Learn more
- Amazon ECS
Container image
Containers are lightweight, portable execution environments that wrap server application software in a filesystem that includes everything it needs to run. Container applications run on supported container runtimes and orchestration services, such as Amazon Elastic Container Service (Amazon ECS) or Amazon Elastic Kubernetes Service (Amazon EKS). Both eliminate the need for you to install and operate your own container orchestration software by managing and scheduling containers on a scalable cluster of virtual machines.
Version release notes
This is the first public release of Injection Attack Suite Runner.
What you get
- A fixed, readable library of prompt-injection test cases (15 in default, about 40 in extended)
- Six families: direct, jailbreak, encoding, indirect, tool abuse, and benign controls
- Adapters for OpenAI-compatible endpoints, Amazon Bedrock (Converse), and custom REST APIs
- Canary-token leak proof: each run plants a fresh marker and records whether it comes back
- Transcripts written as schema v1.0 JSON to a local folder or your own S3 bucket
- API keys resolved from Secrets Manager (or env) and scrubbed from every transcript field
- Distroless, non-root container that runs to completion and exits (ECS task, EKS Job, or Docker)
What this version does not do
- It does not grade or score your guardrail (use Guardrail Effectiveness Scorer for that)
- It does not scan the internet or discover targets
- It does not mutate payloads against a live system to search for new bypasses
Use only on endpoints you own or are explicitly authorized to test.
Additional details
Usage instructions
PREREQUISITES
- Subscribe to this product in AWS Marketplace.
- Have an endpoint you own (or are authorized to test).
- Have Docker installed, or an ECS cluster / EKS cluster ready.
- Keep your API key in AWS Secrets Manager, or export it as an environment variable for a quick local run.
IMPORTANT Only test systems you own or have written permission to test. This tool sends adversarial prompts on purpose.
OPTION A - Quick local run (OpenAI-compatible endpoint)
-
Create an output folder: mkdir -p ./out
-
Put your API key in the shell (example): export TARGET_API_KEY="your-api-key-here"
-
Run the default 15-case suite: docker run --rm -v "$PWD/out:/out"
-e RL_TESTER_TARGET_ADAPTER=openai
-e RL_TESTER_TARGET_URL=https://YOUR-GATEWAY/v1/chat/completions
-e RL_TESTER_MODEL=YOUR-MODEL-ID
-e RL_TESTER_API_KEY_SECRET_ARN=env:TARGET_API_KEY
-e TARGET_API_KEY="$TARGET_API_KEY"
-e RL_TESTER_OUTPUT=/out
709825985650.dkr.ecr.us-east-1.amazonaws.com/rose-lotus/rl-injection:1.0.0 -
Open the transcript JSON written under ./out. That file is your audit record.
OPTION B - Preview the suite without sending traffic
docker run --rm
709825985650.dkr.ecr.us-east-1.amazonaws.com/rose-lotus/rl-injection:1.0.0
-list-payloads
Extended suite list:
docker run --rm
709825985650.dkr.ecr.us-east-1.amazonaws.com/rose-lotus/rl-injection:1.0.0
-list-payloads -suite extended
Dry run (prints the plan, contacts nothing):
docker run --rm
-e RL_TESTER_TARGET_URL=https://YOUR-GATEWAY/v1/chat/completions
-e RL_TESTER_MODEL=YOUR-MODEL-ID
-e RL_TESTER_DRY_RUN=true
709825985650.dkr.ecr.us-east-1.amazonaws.com/rose-lotus/rl-injection:1.0.0
OPTION C - Custom REST endpoint
docker run --rm -v "$PWD/out:/out"
-e RL_TESTER_TARGET_ADAPTER=rest
-e RL_TESTER_TARGET_URL=https://internal.example/v1/ask
-e RL_TESTER_BODY_TEMPLATE='{"query":"{{prompt}}","context":"{{system}}"}'
-e RL_TESTER_RESPONSE_PATH=data.answer
-e RL_TESTER_API_KEY_SECRET_ARN=env:TARGET_API_KEY
-e TARGET_API_KEY="$TARGET_API_KEY"
-e RL_TESTER_OUTPUT=/out
709825985650.dkr.ecr.us-east-1.amazonaws.com/rose-lotus/rl-injection:1.0.0
OPTION E - Write transcripts to S3 (recommended in AWS)
- Store your key in Secrets Manager.
- Give the task role s3:PutObject on your transcript prefix.
- Run with: -e RL_TESTER_API_KEY_SECRET_ARN=arn:aws:secretsmanager:REGION:ACCOUNT:secret:your-key -e RL_TESTER_OUTPUT=s3://YOUR-BUCKET/injection-transcripts
COMMON TUNING
Extended suite: -e RL_TESTER_SUITE=extended
Only some families: -e RL_TESTER_CATEGORIES=direct,jailbreak,benign
If your service owns the system prompt (do not send one): -e RL_TESTER_SEND_SYSTEM=false
Gentle defaults (usually leave alone): -e RL_TESTER_CONCURRENCY=4 -e RL_TESTER_RATE_LIMIT_RPS=2 -e RL_TESTER_TIMEOUT=30s
EXIT CODES
0 = finished and wrote a transcript 1 = config or runtime error 3 = every case failed to reach the target (treat as alert)
Next step: score the transcript with Guardrail Effectiveness Scorer (separate Marketplace product), pointing RL_SCORER_INPUT at the same folder or S3 prefix.
Docs: https://roselotusllc.com/docs/injection-tester Support: support@roselotusllc.com
Support
Vendor support
Support is by email at support@roselotusllc.com , Monday to Friday, 9am to 6pm Eastern, excluding US public holidays.
Growth: response within two business days. Business: response within one business day. Enterprise: response within four business hours, with a named contact and a scheduled onboarding call.
Every tier includes the full product documentation at https://roselotusllc.com/docs/injection-tester , ready to use deployment templates for Docker Compose, ECS RunTask, EKS Jobs and CloudFormation, and the complete payload library in readable form.
Please include your AWS account ID, the product version, the adapter you are using, and the run ID from the transcript. Run IDs appear in the container logs and in the transcript filename. Do not send transcripts unless we ask for them, since they contain your prompts and your model's replies.
For suspected security defects in the product itself, such as a credential appearing in a transcript, write to security@roselotusllc.com rather than opening a normal support ticket.
For private offers, bundle pricing with Guardrail Effectiveness Scorer, or procurement questions, write to sales@roselotusllc.com .
AWS infrastructure support
AWS Support is a one-on-one, fast-response support channel that is staffed 24x7x365 with experienced and technical support engineers. The service helps customers of all sizes and technical abilities to successfully utilize the products and features provided by Amazon Web Services.
Similar products
The SQLi/XSS Rule Group provides the latest protection from the two primary web application attack types: SQL injection and Cross-site scripting.
Cloudbric Managed Rules for AWS WAF - OWASP Top 10 Protection provides security against threats from OWASP Top 10 Web Application Security Risks such as SQL Injection and Cross-Site Scripting (XSS).
Radware Agentic AI Protection is a purpose built security solution designed to protect autonomous AI agents operating across enterprise environments. It provides real time visibility, behavioral threat detection, and continuous AI security posture management to address risks such as rogue agents, prompt injection, data exfiltration, and agent misuse.
CyberArk Agent Guard is an AI agent security tool.
Agent Guard can be used to secure secrets retrieval for agents managed via an external secret provider, such as AWS Secrets Manager and CyberArk Secrets Manager, and traceability of AI agent MCP communications via Agent Guard MCP Proxy.
Cyber Security Cloud Managed Rules are designed to mitigate and minimize vulnerabilities, including all those on OWASP API Security Top 10 Threats list. By using our rulesets, you can start protecting your API Gateway right away with a low false-positive rate and a higher defense capability.
Customer reviews
No customer reviews yet
Be the first to review this product . We've partnered with PeerSpot to gather customer feedback. You can share your experience by writing or recording a review, or scheduling a call with a PeerSpot analyst.