Question

A financial services company runs Amazon Bedrock InvokeModel calls from applications in three AWS accounts across two Regions. The compliance team needs a single, tamper-resistant, centralized record of every model invocation event (including who invoked which model and when) that survives even if an individual account administrator attempts to delete local logs. They also need the log files to be validated for integrity during audits. Which approach best meets these governance requirements?

Accepted Answer

Configure an organization trail in AWS CloudTrail from the management account, enable Bedrock data events, deliver logs to a centralized S3 bucket in a separate logging account with bucket policies restricting deletion, and enable CloudTrail log file integrity validation.

Answer

Enable Bedrock model invocation logging in each account, sending prompts and completions to CloudWatch Logs, and grant the compliance team cross-account read access to each log group.

Answer

Create a separate CloudTrail trail in each account and Region, deliver each to a local S3 bucket, and periodically have each account owner export logs to a shared spreadsheet for the compliance team.

Answer

Enable Amazon Bedrock Guardrails logging in every account and stream intervention events to a central OpenSearch cluster for the compliance team to query.