3.3.2 · Lesson 10 of 15
Data Source Tracking & Traceability
Maintain auditability across data lineage and model invocation calls with catalogs, access control, and invocation logging.
WHAT
Maintain auditability across data lineage and model invocation calls.
HOW
- Register training/RAG schemas in AWS Glue Data Catalog.
- Enforce granular access via AWS Lake Formation.
- Log management/API actions with AWS CloudTrail.
- Enable Amazon Bedrock Model Invocation Logging to record payloads, completions, and metadata to CloudWatch Logs or KMS-encrypted S3.
EXAM TRAP
Invocation logging is disabled by default. VPC Flow Logs and Trusted Advisor do not capture prompt/completion payloads.
Key points
- AWS Glue Data Catalog
- AWS Lake Formation access control
- AWS CloudTrail
- Bedrock Model Invocation Logging
- Encrypted S3 / CloudWatch destinations
Exam focus
Bedrock Model Invocation Logging is opt-in and required when you must audit full prompt texts and completions.