Question

A financial services company must maintain a complete, tamper-evident audit trail of every Amazon Bedrock model invocation for regulatory review. Compliance auditors need to know which IAM principal invoked which model, from which source IP, and at what time — for both console and API activity. The security team already has CloudTrail enabled capturing management events, but during a test they cannot find any records of InvokeModel calls made by the application. What is the correct action to ensure these invocations are auditable?

Accepted Answer

Enable CloudTrail data events for Amazon Bedrock so that InvokeModel and InvokeModelWithResponseStream API activity is logged with the calling principal, source IP, and timestamp.

Answer

Enable Bedrock model invocation logging to CloudWatch Logs and S3, which will automatically populate CloudTrail with the missing InvokeModel records.

Answer

Enable AWS Config with the Bedrock managed rules to record each model invocation as a configuration item for audit review.

Answer

Attach a resource-based policy to the foundation model that forces all InvokeModel calls to be recorded as CloudTrail management events.