Question

A financial services company must demonstrate to auditors that every prompt sent to and every completion returned from foundation models on Amazon Bedrock is captured for a 7-year retention period, including full request and response bodies. Compliance requires that these logs be immutable and stored in a centralized, cost-effective archive that the security team already uses for other audit trails. What is the MOST appropriate way to meet this requirement with the least custom development?

Accepted Answer

Enable Amazon Bedrock model invocation logging and configure it to deliver full request/response data to an Amazon S3 bucket with Object Lock and a lifecycle policy transitioning to S3 Glacier Deep Archive.

Answer

Rely solely on AWS CloudTrail management events to capture the prompts and completions for each InvokeModel call.

Answer

Wrap every Bedrock API call in a custom Lambda function that writes the prompt and response to Amazon DynamoDB with a 7-year TTL.

Answer

Enable Amazon Bedrock model invocation logging to Amazon CloudWatch Logs and set the log group retention to 7 years.