Question

A healthcare startup runs a patient-facing chatbot on Amazon Bedrock. Compliance requires that all model invocations be logged to CloudWatch Logs for auditability, but the security team discovers that raw prompts containing patient names, dates of birth, and medical record numbers are appearing in plaintext in the model invocation logs. The team must retain full audit logging while preventing sensitive data from being stored in CloudWatch. Which approach best satisfies both requirements?

Accepted Answer

Configure a Bedrock Guardrail with PII sensitive information filters set to mask, associate it with the invocations, and keep model invocation logging enabled so the masked content is what gets logged.

Answer

Disable Bedrock model invocation logging entirely and instead rely on CloudTrail management events for the audit trail.

Answer

Enable a CloudWatch Logs subscription filter that deletes any log event matching a PII regex pattern before it is stored.

Answer

Apply an S3 bucket policy with a deny statement on PutObject requests that contain PII in the object body.