Question

A financial services company must maintain a tamper-evident audit trail of all administrative API calls made against its SageMaker resources (creating endpoints, updating endpoint configs, deleting models) across every AWS Region. The compliance team needs to detect any unauthorized configuration changes and be able to query historical activity months later. Which approach best meets these requirements?

Accepted Answer

Enable a multi-Region AWS CloudTrail trail that logs management events to an S3 bucket with Object Lock enabled, and analyze the logs with Athena.

Answer

Enable SageMaker Model Monitor with a data quality baseline to capture all API calls and store violations in CloudWatch.

Answer

Turn on SageMaker Debugger and configure rules to flag any endpoint configuration changes across Regions.

Answer

Stream SageMaker endpoint invocation metrics to CloudWatch Logs and set metric filter alarms on administrative actions.