4.3.2 · Lesson 12 of 16
Bedrock Invocation Logging & Request Visibility
Enable Bedrock Model Invocation Logging so prompts, completions, and token usage are auditable in CloudWatch or S3.
WHAT
Log complete request text, output completions, token usage, and metadata for GenAI operations.
HOW
Enable Bedrock Model Invocation Logs to CloudWatch Logs or S3 encrypted with KMS.
EXAM TRAP
CloudTrail management events alone do not give per-invocation prompt/completion token forensics.
Key points
- Opt-in invocation logging
- Request text + completions
- Token usage metadata
- CloudWatch Logs or KMS-encrypted S3
- Cost driver forensics
Exam focus
Token-level forensic audit requires Bedrock Model Invocation Logging — VPC Flow Logs and S3 access logs do not capture prompts/completions.