A financial services company uses Amazon Bedrock for a customer-facing assistant. To meet regulatory requirements, the compliance team must maintain a tamper-evident record of who invoked which foundation model, when, and from which account, so auditors can review this activity months later. Which AWS service should the team use to capture this audit trail of API activity?