3.6 Privacy Preservation, Source Lineage & Audit Evidence

3.6 Privacy Preservation, Source Lineage & Audit Evidence

Access auditing and invocation evidence

CloudTrail records supported Bedrock API activity and is the primary source for identifying principals and configuration changes. A trail must be protected and retained according to policy; the word immutable applies only when the storage and administrative controls actually enforce it.

Optional Bedrock model invocation logging can deliver configured inference records to CloudWatch Logs, Amazon S3, or both. It is disabled by default, Region-scoped, and currently covers supported calls through the bedrock-runtime endpoint. Payload modality controls include text, image, embedding, audio, and video. Do not rely on an invented metadata-only mode: enable only approved modalities, inspect a synthetic canary record, and monitor delivery-success and delivery-failure metrics.

For workloads where raw prompts must not be retained, keep payload logging disabled for that path or sanitize data before every enabled sink. Application audit records can retain caller, request ID, model target, prompt release, Guardrail version, authorization result, and business outcome without copying protected text. Tokenization or redaction must occur before a downstream log receives the content; retention policy is not a substitute for minimization.

Source lineage links each generated result to source versions, ingestion jobs, parser and chunking configuration, embedding model, vector index version, retrieval settings, prompt release, and model target. Store those identifiers beside evaluation evidence so an auditor can reproduce the decision boundary without granting broad access to the source corpus.

Compliance Framework Matrix

Exam Scenarios & Common Traps

Real-World Exam Scenario

A European healthcare conglomerate is deploying a medical diagnostic assistant on Amazon Bedrock. Under GDPR and German national healthcare regulations, patient consultation notes containing PHI must remain strictly within Germany (eu-central-1). The security team mandates that customer keys must be used for all data at rest, and while all invocation activity must be audited for unauthorized access, actual medical consultation text must never be recorded in audit log files.

Architecture Solution:

1. Direct all application runtime calls to the explicit German model ARN: arn:aws:bedrock:eu-central-1::foundation-model/anthropic.claude-3-5-sonnet-20241022-v2:0, strictly rejecting any eu. cross-region inference profile.
2. Configure an AWS KMS Customer Managed Key (CMK) in eu-central-1 with key policies allowing bedrock.amazonaws.com via service context.
3. Create the OpenSearch Serverless encryption policy specifying the KMS CMK prior to creating the vector collection.
4. Enable Amazon Bedrock Model Invocation Logging to an S3 bucket in eu-central-1, configuring the logging settings to Metadata-Only (textDataDeliveryEnabled: false).

Common Architectural Traps

• Trap 1: Assuming Third-Party Models Exfiltrate Data: Assuming that using Anthropic Claude on Bedrock sends data to Anthropic servers. Claude on Bedrock runs entirely inside AWS data centers with zero data sent to external parties.
• Trap 2: Creating OpenSearch Collections Before Encryption Policies: Attempting to attach a KMS CMK after an OpenSearch Serverless collection is created. The encryption policy must precede collection creation.
• Trap 3: Using Continental Inference Profiles Under Strict Sovereign Mandates: Assuming that the eu. cross-region inference profile satisfies single-country residency. Continental profiles route requests across multiple EU nations and violate national data confinement laws.

Privacy-preserving processing and source lineage

Detect sensitive data before it enters prompts, logs, or training sets. Amazon Macie can discover sensitive information in S3, while Amazon Comprehend PII detection or application logic can identify text fields for masking or tokenization. Choose deletion, redaction, pseudonymization, or reversible tokenization from the business requirement; masking everything can destroy utility, while masking only outputs leaves sensitive inputs exposed.

Apply retention to source objects, intermediate artifacts, invocation logs, and evaluation datasets separately. Record a data-source identifier and version in AWS Glue Data Catalog or another governed catalog, carry source attribution into retrieved chunks, and use CloudTrail plus application decision logs for auditability. Lineage should answer which source version influenced an output without copying restricted source content into an open log.