Check ID: bedrock_model_invocation_logging_enabled
Provider: AWS
Service: bedrock
Severity: MEDIUM
Categories: logging, forensics-ready, gen-ai
Resource type: Other

​
What this check verifies

Bedrock model invocation logging captures request, response, and metadata for Converse, ConverseStream, InvokeModel, and InvokeModelWithResponseStream calls per Region, delivering records to CloudWatch Logs and/or S3 when configured.

​
Risk

Without invocation logs, you lose auditability and forensic visibility into model activity. Credential misuse or prompt injection/jailbreak attempts may go unnoticed, enabling data exfiltration and unauthorized spend. Missing traceability weakens integrity controls and slows incident response.

​
Recommendation

Enable model invocation logging and route events to CloudWatch Logs and/or S3. Enforce least privilege on log access, use encryption, and set retention/lifecycle policies. Monitor for anomalies and alerts to support defense in depth and separation of duties.

​
Remediation

aws bedrock put-model-invocation-logging-configuration --logging-config '{"s3Config":{"bucketName":"<example_resource_name>"},"textDataDeliveryEnabled":true}'

​
References

​
Where this check fires

This check runs on every scheduled scan against your AWS account. Findings appear at Cloud Security → Findings filterable by Check ID = bedrock_model_invocation_logging_enabled. To re-evaluate after a fix, hit Run now on the account’s schedule under Cloud Security → Schedules — the next scan re-checks this control and marks the finding fixed or keeps it persistent.
← Back to AWS checks