9.3 Invocation Logging, CloudTrail Auditing & Observability
Key Takeaways
- Model invocation logging is optional, Region-scoped, and endpoint-specific.
- CloudWatch Logs and S3 are supported destinations, with independent modality controls and S3 handling for large data.
- CloudTrail, invocation logs, metrics, and application audit records answer different questions.
- Protect payload logs as sensitive data and test retention, redaction, and delivery-failure handling.
- Use request IDs and approved metadata to correlate evidence without copying raw content everywhere.
9.3 Invocation Logging, CloudTrail Auditing & Observability
Amazon Bedrock exposes three complementary evidence sources: CloudWatch service metrics, AWS CloudTrail events, and optional model invocation logging. They answer different questions and none should be described as a complete substitute for the others.
Model invocation logging
Model invocation logging is disabled by default and is configured per account and Region. Current documentation applies it to supported calls through the bedrock-runtime endpoint, including Converse, ConverseStream, InvokeModel, and InvokeModelWithResponseStream. Calls through other endpoint surfaces can have different observability support, so identify the actual endpoint before promising coverage.
The logging configuration can deliver records to CloudWatch Logs, Amazon S3, or both. A record includes invocation metadata and, when the selected modality is enabled, request and response bodies. Large JSON or binary data can be placed in S3 with a reference in the log record. Text, image, embedding, audio, and video delivery controls are independent fields in the current API; availability depends on the request and model.
Disabling a modality prevents that modality's payload from being selected for delivery. Do not invent a named metadata-only product tier or promise a particular record shape without testing the configuration. If privacy policy forbids retaining raw prompts, the strongest pattern is to avoid enabling payload logging for that path or sanitize the request in a trusted layer before it reaches every configured sink. Confirm the produced record with a canary that contains synthetic markers.
Protect the evidence pipeline
Invocation logs can contain personal data, secrets, retrieved passages, tool material, or copyrighted content. Keep destinations in the supported account and Region, restrict the delivery role and readers, encrypt data, block public S3 access, and define lifecycle and deletion behavior. If regulation requires write-once retention, configure and test S3 Object Lock, retention mode, legal holds, and the permissions that can alter them. Calling an ordinary bucket immutable is insufficient.
Monitor the delivery metrics for CloudWatch and S3 success and failure. A successful inference does not prove its optional log was delivered. Alert on sustained delivery failure, test KMS and destination policies, and record the recovery procedure. Control access to queries and exports as carefully as access to the source log.
Use stable requestMetadata fields for approved low-cardinality labels such as team, environment, feature, or experiment. Do not place personal data or credentials in metadata. Request metadata is caller-supplied, is retained only when invocation logging is enabled, and is not itself a cost-allocation tag.
CloudTrail and application evidence
CloudTrail records supported Bedrock API activity. Management events are appropriate for questions such as who changed an agent, Guardrail, Knowledge Base, or logging configuration. Some runtime activity requires data-event configuration or has resource-specific support. CloudTrail records API identity and request context; it is not the service for retaining complete prompt and response payloads.
An application audit record should link an authenticated business request to the Bedrock request ID, model or inference profile, prompt release, Guardrail version, retrieval and tool outcome, and final business action without copying sensitive content by default. Hashes or governed object references can preserve linkage when raw material must live in a more restricted evidence store.
Incident reconstruction
For a suspicious response, identify the endpoint, Region, caller, operation, request ID, model target, release version, and UTC time. Correlate CloudTrail, invocation delivery records, application traces, Guardrail findings, tool audit logs, and CloudWatch metrics. Preserve the minimum authorized evidence and document gaps. A missing payload can be intentional privacy design; a missing delivery event can be an observability failure.
The exam distinction is straightforward: CloudWatch metrics show aggregate service behavior, CloudTrail shows supported API activity and configuration changes, model invocation logging can capture configured inference records, and application logs connect those AWS events to business authorization and outcomes.
Verification drill
Before relying on the audit design, send synthetic canary requests containing unique text, image, and metadata markers. Confirm which records reach CloudWatch Logs and S3, which bodies are inline or referenced, whether disabled modalities are absent, and whether request IDs join correctly to application and CloudTrail evidence. Then simulate a denied destination write or inaccessible KMS key and verify that delivery-failure metrics alert the named owner.
Test retention separately: attempt deletion with ordinary operator permissions, exercise an approved legal-hold path, and confirm lifecycle behavior after the retention period. Finally, run a privacy query that searches for a synthetic sensitive marker. The result should match the documented minimization or masking decision. These checks turn a diagram into auditable evidence.
A financial enterprise must retain masked prompts and responses for seven years, and no retained payload log may contain an unmasked SSN or card number. Which design satisfies the requirement?
A security incident response team discovers that a production Bedrock Agent's Action Group schema was modified to route queries to an unauthorized external endpoint. The security engineer must identify the IAM principal that performed this unauthorized modification, the exact timestamp, and the source IP address. Which AWS auditing source should the engineer inspect?
A digital media agency uses Amazon Bedrock to run high-volume marketing copy generation and generate high-resolution campaign imagery using diffusion models. The lead developer needs to monitor prompt text and token consumption in real time via CloudWatch Logs to detect abusive language, but wants to prevent high-resolution generated image binaries from being written to CloudWatch to avoid excessive ingestion costs. How should the developer configure Bedrock Model Invocation Logging?