Bedrock Service Should Enable Model Invocation Logging

Using Console

Below are concise, console-based steps to enable Model Invocation Logging for Amazon Bedrock.

1. Prerequisites

CloudWatch log group (optional – you can create it during setup):
- Go to CloudWatch → Logs → Log groups → Create log group.
S3 bucket for storing logs:
- Go to S3 → Create bucket (or pick an existing bucket).
IAM role for Bedrock logging (can also be auto-created):
- Role will need permissions to:
  - logs:CreateLogStream, logs:PutLogEvents on the log group
  - s3:PutObject on the S3 bucket

2. Open Bedrock Model Invocation Logging

In the AWS Console, go to Amazon Bedrock.
In the left navigation pane, select Model invocation logging (sometimes under Settings or Data and governance, depending on the UI).

3. Enable Model Invocation Logging

On the Model invocation logging page, choose Enable (or Edit if partially configured).
Under Logging destinations, configure:
- CloudWatch Logs:
  - Select Enable CloudWatch Logs.
  - Choose an existing Log group or create a new one.
- Amazon S3:
  - Select Enable S3 logging.
  - Choose the S3 bucket and an optional prefix/folder for logs.

4. Select What to Log

Under Request logging, choose if you want to log:
- Input prompts/parameters
- Output responses
- Any specific content types (e.g., text, images), if offered.
Choose All models or Specific models based on your policy.
If available, configure:
- Redaction / anonymization options for sensitive fields.
- Truncation limits for large payloads.

5. Configure IAM Role for Logging

Under IAM role or Execution role, choose:
- Create new role: let Bedrock create one with the necessary permissions; or
- Use existing role: select an IAM role that has:
  - Access to the specified CloudWatch log group.
  - Access to write logs to the S3 bucket.
Save or apply the role selection.

6. Save and Verify

Click Save, Apply, or Enable logging (label may vary).
Test:
- Invoke a model via the Bedrock console playground or your application.
- Check:
  - CloudWatch → Logs → Log groups → your log group → latest log stream for entries.
  - S3 → your bucket → prefix for new log objects.

Enabling this at the account/Regional level via the Model invocation logging settings ensures the misconfiguration (“Bedrock Service Should Enable Model Invocation Logging”) is remediated for that Region. Repeat for other Regions if required by your policy.

Using CLI

To enable Bedrock model invocation logging via AWS CLI you:

Decide where to send logs
Bedrock supports three destinations (you can use one or more):
- Amazon S3
- CloudWatch Logs
- Kinesis Data Firehose
I’ll show S3 and CloudWatch Logs, which are most common.

1. Create / choose a log destination

Option A – S3 bucket for logs

aws s3api create-bucket \
  --bucket my-bedrock-invocation-logs \
  --region us-east-1 \
  --create-bucket-configuration LocationConstraint=us-east-1

(If the bucket already exists, skip.)

Option B – CloudWatch Logs log group

aws logs create-log-group \
  --log-group-name /aws/bedrock/model-invocations

2. Create IAM role for Bedrock logging

Bedrock needs an IAM role it can assume to write logs.

2.1 Trust policy

Save as bedrock-logging-trust.json:

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Principal": {
        "Service": "bedrock.amazonaws.com"
      },
      "Action": "sts:AssumeRole"
    }
  ]
}

Create the role:

aws iam create-role \
  --role-name BedrockInvocationLoggingRole \
  --assume-role-policy-document file://bedrock-logging-trust.json

Note the returned Arn, e.g.:arn:aws:iam::123456789012:role/BedrockInvocationLoggingRole

2.2 Permissions policy for S3 and/or CloudWatch Logs

Example policy for both S3 and CloudWatch Logs.
Adjust bucket name, region, and log group ARN.Save as bedrock-logging-permissions.json:

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Sid": "S3WriteAccessForInvocationLogs",
      "Effect": "Allow",
      "Action": [
        "s3:PutObject",
        "s3:PutObjectAcl",
        "s3:GetBucketLocation"
      ],
      "Resource": [
        "arn:aws:s3:::my-bedrock-invocation-logs",
        "arn:aws:s3:::my-bedrock-invocation-logs/*"
      ]
    },
    {
      "Sid": "CloudWatchLogsAccessForInvocationLogs",
      "Effect": "Allow",
      "Action": [
        "logs:CreateLogGroup",
        "logs:CreateLogStream",
        "logs:DescribeLogGroups",
        "logs:DescribeLogStreams",
        "logs:PutLogEvents"
      ],
      "Resource": "arn:aws:logs:us-east-1:123456789012:log-group:/aws/bedrock/model-invocations:*"
    }
  ]
}

Attach the policy to the role:

aws iam put-role-policy \
  --role-name BedrockInvocationLoggingRole \
  --policy-name BedrockInvocationLoggingInlinePolicy \
  --policy-document file://bedrock-logging-permissions.json

3. Enable model invocation logging in Bedrock

Use put-model-invocation-logging-configuration.Create bedrock-logging-config.json (S3 + CloudWatch Logs example):

{
  "loggingConfig": {
    "roleArn": "arn:aws:iam::123456789012:role/BedrockInvocationLoggingRole",
    "cloudWatchConfig": {
      "logGroupName": "/aws/bedrock/model-invocations",
      "roleArn": "arn:aws:iam::123456789012:role/BedrockInvocationLoggingRole",
      "enabled": true
    },
    "s3Config": {
      "bucketName": "my-bedrock-invocation-logs",
      "textDataDeliveryEnabled": true,
      "imageDataDeliveryEnabled": true,
      "embeddingDataDeliveryEnabled": true
    },
    "kinesisFirehoseConfig": {
      "deliveryStreamArn": "",
      "textDataDeliveryEnabled": false,
      "imageDataDeliveryEnabled": false,
      "embeddingDataDeliveryEnabled": false
    }
  }
}

Then call:

aws bedrock put-model-invocation-logging-configuration \
  --cli-input-json file://bedrock-logging-config.json

4. Verify configuration

aws bedrock get-model-invocation-logging-configuration

You should see your loggingConfig with enabled/delivery flags set to true. Logs will start appearing when you invoke models via Bedrock in that account/region.

Using Python

To remediate “Bedrock Service Should Enable Model Invocation Logging” using Python, you need to configure Bedrock’s model invocation logging via the PutModelInvocationLoggingConfiguration API (boto3: put_model_invocation_logging_configuration).Below are the step‑by‑step instructions and a minimal Python example.

1. Prerequisites

AWS Permissions The IAM principal running the script needs (at minimum):

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": [
        "bedrock:PutModelInvocationLoggingConfiguration",
        "iam:PassRole"
      ],
      "Resource": "*"
    }
  ]
}

Create an IAM role for logging (if you don’t have one) This role is assumed by the Bedrock service to write logs to CloudWatch and S3. Trust policy (trust relationship):

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Principal": {
        "Service": "bedrock.amazonaws.com"
      },
      "Action": "sts:AssumeRole"
    }
  ]
}

Permissions policy attached to that role (adjust ARNs as needed):

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": [
        "logs:CreateLogGroup",
        "logs:CreateLogStream",
        "logs:PutLogEvents",
        "logs:DescribeLogStreams"
      ],
      "Resource": "*"
    },
    {
      "Effect": "Allow",
      "Action": [
        "s3:PutObject",
        "s3:AbortMultipartUpload",
        "s3:ListBucketMultipartUploads",
        "s3:ListBucket",
        "s3:GetBucketLocation"
      ],
      "Resource": [
        "arn:aws:s3:::YOUR-BEDROCK-LOGS-BUCKET",
        "arn:aws:s3:::YOUR-BEDROCK-LOGS-BUCKET/*"
      ]
    }
  ]
}

Note the role ARN (e.g. arn:aws:iam::123456789012:role/bedrock-logging-role).

Create destinations
- CloudWatch Log Group (optional but recommended):
  e.g. /aws/bedrock/model-invocations
- S3 bucket for logs:
  e.g. your-bedrock-logs-bucket (and optional prefix, e.g. bedrock/invocations/)

2. Python: Enable Bedrock Model Invocation Logging

Install boto3 if needed:

pip install boto3

Then use this Python script (adjust ARNs, regions, bucket names):

import boto3

region = "us-east-1"  # change to your region

bedrock_client = boto3.client("bedrock", region_name=region)

# REQUIRED: role that Bedrock will assume to write logs
logging_role_arn = "arn:aws:iam::123456789012:role/bedrock-logging-role"

# OPTIONAL: CloudWatch Logs destination
cloudwatch_log_group = "/aws/bedrock/model-invocations"

# OPTIONAL: S3 destination
s3_bucket_name = "your-bedrock-logs-bucket"
s3_prefix = "bedrock/invocations/"  # optional

# OPTIONAL: KMS key for encryption (if you use customer-managed keys)
# kms_key_arn = "arn:aws:kms:us-east-1:123456789012:key/your-key-id"

config = {
    "roleArn": logging_role_arn,
    "cloudWatchConfig": {
        "logGroupName": cloudwatch_log_group,
        "roleArn": logging_role_arn,
        "enabled": True
    },
    "s3Config": {
        "bucketName": s3_bucket_name,
        "prefix": s3_prefix,
        "roleArn": logging_role_arn,
        "enabled": True
    },
    # Optional: fine-grained control
    "textDataDeliveryEnabled": True,
    "imageDataDeliveryEnabled": True,
    "embeddingDataDeliveryEnabled": True
    # If using KMS:
    # "kmsKeyArn": kms_key_arn
}

response = bedrock_client.put_model_invocation_logging_configuration(
    loggingConfig=config
)

print("PutModelInvocationLoggingConfiguration response:")
print(response)

3. Verify the Configuration

Use:

import boto3

region = "us-east-1"
bedrock_client = boto3.client("bedrock", region_name=region)

resp = bedrock_client.get_model_invocation_logging_configuration()
print(resp)

Confirm:

cloudWatchConfig.enabled is True (if used)
s3Config.enabled is True (if used)
The correct roleArn is set
Test a Bedrock model invocation and check:
- CloudWatch Logs → Log group /aws/bedrock/model-invocations
- S3 → s3://your-bedrock-logs-bucket/bedrock/invocations/

Enabling this configuration remediates the finding that Bedrock model invocation logging is not enabled.

AWS Introduction

AWS Pricing

AWS Threats

AWS Misconfigurations

Bedrock Service Should Enable Model Invocation Logging

More Info:

Risk Level

Address

Compliance Standards

Triage and Remediation

Remediation

1. Prerequisites

2. Open Bedrock Model Invocation Logging

3. Enable Model Invocation Logging

4. Select What to Log

5. Configure IAM Role for Logging

6. Save and Verify

1. Create / choose a log destination

Option A – S3 bucket for logs

Option B – CloudWatch Logs log group

2. Create IAM role for Bedrock logging

2.1 Trust policy

2.2 Permissions policy for S3 and/or CloudWatch Logs

3. Enable model invocation logging in Bedrock

4. Verify configuration

1. Prerequisites

2. Python: Enable Bedrock Model Invocation Logging

3. Verify the Configuration

​More Info:

​Risk Level

​Address

​Compliance Standards

​Triage and Remediation

​Remediation

​1. Prerequisites

​2. Open Bedrock Model Invocation Logging

​3. Enable Model Invocation Logging

​4. Select What to Log

​5. Configure IAM Role for Logging

​6. Save and Verify

​1. Create / choose a log destination

​Option A – S3 bucket for logs

​Option B – CloudWatch Logs log group

​2. Create IAM role for Bedrock logging

​2.1 Trust policy

​2.2 Permissions policy for S3 and/or CloudWatch Logs

​3. Enable model invocation logging in Bedrock

​4. Verify configuration

​1. Prerequisites

​2. Python: Enable Bedrock Model Invocation Logging

​3. Verify the Configuration

More Info:

Risk Level

Address

Compliance Standards

Triage and Remediation

Remediation

1. Prerequisites

2. Open Bedrock Model Invocation Logging

3. Enable Model Invocation Logging

4. Select What to Log

5. Configure IAM Role for Logging

6. Save and Verify

1. Create / choose a log destination

Option A – S3 bucket for logs

Option B – CloudWatch Logs log group

2. Create IAM role for Bedrock logging

2.1 Trust policy

2.2 Permissions policy for S3 and/or CloudWatch Logs

3. Enable model invocation logging in Bedrock

4. Verify configuration

1. Prerequisites

2. Python: Enable Bedrock Model Invocation Logging

3. Verify the Configuration