CloudTrail logs Amazon Bedrock API calls for security auditing
cloudtrail_bedrock_logging_enabled
At least one actively logging CloudTrail trail records Amazon Bedrock API activity through management events or advanced event selectors targeting Bedrock resources.
This check covers control-plane operations such as configuration changes through CloudTrail management events and can also cover data-plane Bedrock events when advanced event selectors target Bedrock resource types.
Risk
Without CloudTrail logging for Bedrock control-plane operations, changes to prompts, guardrails, agents, flows, or knowledge bases can become invisible, weakening forensics and incident response. Management events do not capture InvokeModel; pair this control with bedrock_model_invocation_logging_enabled or Bedrock data event selectors for invocation visibility.
prowler aws --checks cloudtrail_bedrock_logging_enabled
Recommendation
Enable CloudTrail logging for Amazon Bedrock on at least one actively logging trail. At minimum, enable management events to capture Bedrock control-plane operations. For invocation-level and other data-plane visibility, add advanced event selectors targeting Bedrock resource types or pair this control with bedrock_model_invocation_logging_enabled.
For broader region coverage, pair this control with a separate multi-region CloudTrail check. Centralize logs in an encrypted bucket or CloudWatch Logs to support defense in depth and forensic readiness for AI workloads.
Remediation
aws cloudtrail put-event-selectors --trail-name <example_resource_name> --advanced-event-selectors '[{"Name":"Bedrock data events","FieldSelectors":[{"Field":"eventCategory","Equals":["Data"]},{"Field":"resources.type","Equals":["AWS::Bedrock::Model","AWS::Bedrock::Guardrail","AWS::Bedrock::AgentAlias","AWS::Bedrock::FlowAlias","AWS::Bedrock::InlineAgent","AWS::Bedrock::KnowledgeBase","AWS::Bedrock::Prompt"]}]}]'
- In the AWS Console, open CloudTrail and select a trail that is actively logging
- Edit the trail and enable Management events to capture Bedrock control-plane operations, or add Bedrock advanced data event selectors for data-plane visibility
- If using data events, select the Bedrock resource types you want to log
- Save changes and confirm the trail remains in logging state
Source Code
Resource Type
AwsCloudTrailTrail
References
Related To
- cloudtrail_multi_region_enabled_logging_management_events
- bedrock_model_invocation_logging_enabled