Check ID: bedrock_model_invocation_logs_encryption_enabled
Provider: AWS
Service: bedrock
Severity: HIGH
Categories: encryption, logging, gen-ai
Resource type: AwsS3Bucket

​
What this check verifies

Bedrock model invocation logs are stored in encrypted destinations: S3 buckets with bucket encryption and CloudWatch Logs groups protected by an AWS KMS key. This evaluates whether configured log targets enforce encryption at rest for request/response content and associated metadata.

​
Risk

Without encryption at rest, prompts, outputs, images, and token/usage metadata in logs can be read if S3 or CloudWatch storage or replicas are accessed by unauthorized principals. Impacts:
  • Loss of data confidentiality
  • Secret or PII exposure enabling account abuse
  • Operational intel for lateral movement

​
Recommendation

Ensure all invocation logs are encrypted end to end:
  • Enable S3 default encryption, preferably SSE-KMS, and restrict key usage
  • Assign a KMS key to CloudWatch log groups
  • Enforce least privilege on keys and logs, rotate keys, and monitor access for defense in depth

​
Remediation

resource "aws_s3_bucket" "example" {
  bucket = "<example_resource_name>"
}

resource "aws_s3_bucket_server_side_encryption_configuration" "example" {
  bucket = aws_s3_bucket.example.id
  rule {
    apply_server_side_encryption_by_default {
      sse_algorithm = "AES256"  # critical: enables default encryption for the S3 bucket
    }
  }
}

resource "aws_cloudwatch_log_group" "example" {
  name       = "<example_resource_name>"
  kms_key_id = "<example_kms_key_arn>"  # critical: encrypts the log group with a KMS key
}

​
References

​
Where this check fires

This check runs on every scheduled scan against your AWS account. Findings appear at Cloud Security → Findings filterable by Check ID = bedrock_model_invocation_logs_encryption_enabled. To re-evaluate after a fix, hit Run now on the account’s schedule under Cloud Security → Schedules — the next scan re-checks this control and marks the finding fixed or keeps it persistent.
← Back to AWS checks