Question

A financial services company must produce a quarterly compliance report showing every time a developer or automated role was GRANTED or REVOKED access to a specific foundation model in Amazon Bedrock, including who made the change and when. The security team already collects Bedrock InvokeModel data events but auditors say these logs do not answer the question. Which approach correctly captures the required model-access administrative history?

Accepted Answer

Enable CloudTrail management events, which record Bedrock control-plane API calls such as PutFoundationModelEntitlement/ListFoundationModels access changes and IAM policy modifications affecting model access.

Answer

Increase the retention of the existing Bedrock model invocation logging S3 bucket so InvokeModel data events are kept for the full quarter.

Answer

Enable Bedrock Guardrails logging to CloudWatch so intervention events show who was denied access to the model.

Answer

Use Amazon Bedrock model evaluation jobs to generate a report of which roles invoked the model during the quarter.