Question

A financial services company runs a customer-facing chatbot on Amazon Bedrock with a Guardrail attached. Compliance requires a tamper-evident audit trail that captures WHO (which IAM principal) invoked the model and WHEN, so auditors can trace every model invocation back to a specific application role during quarterly reviews. Separately, the security team wants to inspect the actual prompt text and Guardrail intervention details for blocked requests. Which combination of AWS features satisfies BOTH requirements with the least custom code?

Accepted Answer

Enable Bedrock model invocation logging to CloudWatch/S3 for the prompt and Guardrail intervention data, and rely on CloudTrail data events for InvokeModel to record the IAM principal and timestamp of each invocation.

Answer

Enable only CloudTrail management events, which capture both the IAM principal and the full prompt content for every InvokeModel call.

Answer

Enable only Bedrock model invocation logging, which records the IAM principal identity, timestamp, prompt text, and Guardrail interventions in a single tamper-evident log.

Answer

Write a Lambda wrapper around every InvokeModel call that logs the caller identity and prompt to DynamoDB, since neither CloudTrail nor invocation logging captures Guardrail data.