Management and Governance
AWS CloudTrail
AWS CloudTrail records supported AWS control-plane and data events for audit and investigation. It shows who called an API and with which resource context, but it does not replace application-level GenAI decision logs.
Key points
- Management events cover resource configuration operations by default in event history
- Selected data events capture high-volume resource actions when enabled
- Trails can deliver immutable-oriented records to governed S3 and CloudWatch Logs destinations
When to use it
- Audit changes to model, prompt, and IAM configuration
- Investigate which role invoked a sensitive Bedrock operation
Exam tips
- Use CloudTrail for AWS API activity and add correlation-aware application logs for prompt and response lineage
- Enable only required data events and protect trail storage against alteration