Bedrock Service Should Enable Model Invocation Logging

More Info:

Bedrock Service should enable model invocation logging

Risk Level

Medium

Address

Security

Compliance Standards

• APRA CPS 234 (Australia)
• BSI C5 (Germany)
• Brazil LGPD
• CCPA / CPRA (California)
• CIS Critical Security Controls v8
• CMMC 2.0
• CSA Cloud Controls Matrix v4
• DPDPA
• Digital Operational Resilience Act (EU)
• ISO/IEC 27018
• ISO/IEC 27701
• MAS Technology Risk Management (Singapore)
• MITRE ATT&CK (Cloud)
• NIST SP 800-171
• NYDFS 23 NYCRR 500
• SOC2
• SWIFT Customer Security Controls Framework
• Sarbanes-Oxley IT General Controls
• StateRAMP
• UK NCSC Cyber Assessment Framework

Triage and Remediation

Remediation

Remediation

Using Console

Below are concise, console-based steps to enable Model Invocation Logging for Amazon Bedrock.

---

1. Prerequisites

1. CloudWatch log group (optional – you can create it during setup):
   • Go to CloudWatch → Logs → Log groups → Create log group.
2. S3 bucket for storing logs:
   • Go to S3 → Create bucket (or pick an existing bucket).
3. IAM role for Bedrock logging (can also be auto-created):
   • Role will need permissions to:
     • logs:CreateLogStream, logs:PutLogEvents on the log group
     • s3:PutObject on the S3 bucket

---

2. Open Bedrock Model Invocation Logging

1. In the AWS Console, go to Amazon Bedrock.
2. In the left navigation pane, select Model invocation logging (sometimes under Settings or Data and governance, depending on the UI).

---

3. Enable Model Invocation Logging

1. On the Model invocation logging page, choose Enable (or Edit if partially configured).
2. Under Logging destinations, configure:
   • CloudWatch Logs:
     • Select Enable CloudWatch Logs.
     • Choose an existing Log group or create a new one.
   • Amazon S3:
     • Select Enable S3 logging.
     • Choose the S3 bucket and an optional prefix/folder for logs.

---

4. Select What to Log

1. Under Request logging, choose if you want to log:
   • Input prompts/parameters
   • Output responses
   • Any specific content types (e.g., text, images), if offered.
2. Choose All models or Specific models based on your policy.
3. If available, configure:
   • Redaction / anonymization options for sensitive fields.
   • Truncation limits for large payloads.

---

5. Configure IAM Role for Logging

1. Under IAM role or Execution role, choose:
   • Create new role: let Bedrock create one with the necessary permissions; or
   • Use existing role: select an IAM role that has:
     • Access to the specified CloudWatch log group.
     • Access to write logs to the S3 bucket.
2. Save or apply the role selection.

---

6. Save and Verify

1. Click Save, Apply, or Enable logging (label may vary).
2. Test:
   • Invoke a model via the Bedrock console playground or your application.
   • Check:
     • CloudWatch → Logs → Log groups → your log group → latest log stream for entries.
     • S3 → your bucket → prefix for new log objects.

---

Enabling this at the account/Regional level via the Model invocation logging settings ensures the misconfiguration (“Bedrock Service Should Enable Model Invocation Logging”) is remediated for that Region. Repeat for other Regions if required by your policy.

Using CLI

To enable Bedrock model invocation logging via AWS CLI you:

1. Decide where to send logs
   Bedrock supports three destinations (you can use one or more):

   • Amazon S3
   • CloudWatch Logs
   • Kinesis Data Firehose

   I’ll show S3 and CloudWatch Logs, which are most common.

---

1. Create / choose a log destination

Option A – S3 bucket for logs

aws s3api create-bucket \
  --bucket my-bedrock-invocation-logs \
  --region us-east-1 \
  --create-bucket-configuration LocationConstraint=us-east-1

(If the bucket already exists, skip.)

Option B – CloudWatch Logs log group

aws logs create-log-group \
  --log-group-name /aws/bedrock/model-invocations

---

2. Create IAM role for Bedrock logging

Bedrock needs an IAM role it can assume to write logs.

2.1 Trust policy

Save as bedrock-logging-trust.json:

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Principal": {
        "Service": "bedrock.amazonaws.com"
      },
      "Action": "sts:AssumeRole"
    }
  ]
}

Create the role:

aws iam create-role \
  --role-name BedrockInvocationLoggingRole \
  --assume-role-policy-document file://bedrock-logging-trust.json

Note the returned Arn, e.g.:

arn:aws:iam::123456789012:role/BedrockInvocationLoggingRole

---

2.2 Permissions policy for S3 and/or CloudWatch Logs

Example policy for both S3 and CloudWatch Logs.
Adjust bucket name, region, and log group ARN.

Save as bedrock-logging-permissions.json:

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Sid": "S3WriteAccessForInvocationLogs",
      "Effect": "Allow",
      "Action": [
        "s3:PutObject",
        "s3:PutObjectAcl",
        "s3:GetBucketLocation"
      ],
      "Resource": [
        "arn:aws:s3:::my-bedrock-invocation-logs",
        "arn:aws:s3:::my-bedrock-invocation-logs/*"
      ]
    },
    {
      "Sid": "CloudWatchLogsAccessForInvocationLogs",
      "Effect": "Allow",
      "Action": [
        "logs:CreateLogGroup",
        "logs:CreateLogStream",
        "logs:DescribeLogGroups",
        "logs:DescribeLogStreams",
        "logs:PutLogEvents"
      ],
      "Resource": "arn:aws:logs:us-east-1:123456789012:log-group:/aws/bedrock/model-invocations:*"
    }
  ]
}

Attach the policy to the role:

aws iam put-role-policy \
  --role-name BedrockInvocationLoggingRole \
  --policy-name BedrockInvocationLoggingInlinePolicy \
  --policy-document file://bedrock-logging-permissions.json

---

3. Enable model invocation logging in Bedrock

Use put-model-invocation-logging-configuration.

Create bedrock-logging-config.json (S3 + CloudWatch Logs example):

{
  "loggingConfig": {
    "roleArn": "arn:aws:iam::123456789012:role/BedrockInvocationLoggingRole",
    "cloudWatchConfig": {
      "logGroupName": "/aws/bedrock/model-invocations",
      "roleArn": "arn:aws:iam::123456789012:role/BedrockInvocationLoggingRole",
      "enabled": true
    },
    "s3Config": {
      "bucketName": "my-bedrock-invocation-logs",
      "textDataDeliveryEnabled": true,
      "imageDataDeliveryEnabled": true,
      "embeddingDataDeliveryEnabled": true
    },
    "kinesisFirehoseConfig": {
      "deliveryStreamArn": "",
      "textDataDeliveryEnabled": false,
      "imageDataDeliveryEnabled": false,
      "embeddingDataDeliveryEnabled": false
    }
  }
}

Then call:

aws bedrock put-model-invocation-logging-configuration \
  --cli-input-json file://bedrock-logging-config.json

---

4. Verify configuration

aws bedrock get-model-invocation-logging-configuration

You should see your loggingConfig with enabled/delivery flags set to true. Logs will start appearing when you invoke models via Bedrock in that account/region.

Using Python

To remediate “Bedrock Service Should Enable Model Invocation Logging” using Python, you need to configure Bedrock’s model invocation logging via the PutModelInvocationLoggingConfiguration API (boto3: put_model_invocation_logging_configuration).

Below are the step‑by‑step instructions and a minimal Python example.

---

1. Prerequisites

1. AWS Permissions

   The IAM principal running the script needs (at minimum):

   {
     "Version": "2012-10-17",
     "Statement": [
       {
         "Effect": "Allow",
         "Action": [
           "bedrock:PutModelInvocationLoggingConfiguration",
           "iam:PassRole"
         ],
         "Resource": "*"
       }
     ]
   }

2. Create an IAM role for logging (if you don’t have one)

   This role is assumed by the Bedrock service to write logs to CloudWatch and S3.

   Trust policy (trust relationship):

   {
     "Version": "2012-10-17",
     "Statement": [
       {
         "Effect": "Allow",
         "Principal": {
           "Service": "bedrock.amazonaws.com"
         },
         "Action": "sts:AssumeRole"
       }
     ]
   }

   Permissions policy attached to that role (adjust ARNs as needed):

   {
     "Version": "2012-10-17",
     "Statement": [
       {
         "Effect": "Allow",
         "Action": [
           "logs:CreateLogGroup",
           "logs:CreateLogStream",
           "logs:PutLogEvents",
           "logs:DescribeLogStreams"
         ],
         "Resource": "*"
       },
       {
         "Effect": "Allow",
         "Action": [
           "s3:PutObject",
           "s3:AbortMultipartUpload",
           "s3:ListBucketMultipartUploads",
           "s3:ListBucket",
           "s3:GetBucketLocation"
         ],
         "Resource": [
           "arn:aws:s3:::YOUR-BEDROCK-LOGS-BUCKET",
           "arn:aws:s3:::YOUR-BEDROCK-LOGS-BUCKET/*"
         ]
       }
     ]
   }

   Note the role ARN (e.g. arn:aws:iam::123456789012:role/bedrock-logging-role).

3. Create destinations

   • CloudWatch Log Group (optional but recommended):
     e.g. /aws/bedrock/model-invocations
   • S3 bucket for logs:
     e.g. your-bedrock-logs-bucket (and optional prefix, e.g. bedrock/invocations/)

---

2. Python: Enable Bedrock Model Invocation Logging

Install boto3 if needed:

pip install boto3

Then use this Python script (adjust ARNs, regions, bucket names):

import boto3

region = "us-east-1"  # change to your region

bedrock_client = boto3.client("bedrock", region_name=region)

# REQUIRED: role that Bedrock will assume to write logs
logging_role_arn = "arn:aws:iam::123456789012:role/bedrock-logging-role"

# OPTIONAL: CloudWatch Logs destination
cloudwatch_log_group = "/aws/bedrock/model-invocations"

# OPTIONAL: S3 destination
s3_bucket_name = "your-bedrock-logs-bucket"
s3_prefix = "bedrock/invocations/"  # optional

# OPTIONAL: KMS key for encryption (if you use customer-managed keys)
# kms_key_arn = "arn:aws:kms:us-east-1:123456789012:key/your-key-id"

config = {
    "roleArn": logging_role_arn,
    "cloudWatchConfig": {
        "logGroupName": cloudwatch_log_group,
        "roleArn": logging_role_arn,
        "enabled": True
    },
    "s3Config": {
        "bucketName": s3_bucket_name,
        "prefix": s3_prefix,
        "roleArn": logging_role_arn,
        "enabled": True
    },
    # Optional: fine-grained control
    "textDataDeliveryEnabled": True,
    "imageDataDeliveryEnabled": True,
    "embeddingDataDeliveryEnabled": True
    # If using KMS:
    # "kmsKeyArn": kms_key_arn
}

response = bedrock_client.put_model_invocation_logging_configuration(
    loggingConfig=config
)

print("PutModelInvocationLoggingConfiguration response:")
print(response)

---

3. Verify the Configuration

Use:

import boto3

region = "us-east-1"
bedrock_client = boto3.client("bedrock", region_name=region)

resp = bedrock_client.get_model_invocation_logging_configuration()
print(resp)

Confirm:

• cloudWatchConfig.enabled is True (if used)
• s3Config.enabled is True (if used)
• The correct roleArn is set
• Test a Bedrock model invocation and check:
  • CloudWatch Logs → Log group /aws/bedrock/model-invocations
  • S3 → s3://your-bedrock-logs-bucket/bedrock/invocations/

Enabling this configuration remediates the finding that Bedrock model invocation logging is not enabled.

Using Terraform

# As of the current AWS provider version, Bedrock model invocation logging
# configuration is NOT exposed as a Terraform-managed resource.
# It cannot be remediated via Terraform; you must use the AWS CLI or Console.

# CONSOLE/CLI INSTRUCTIONS (manual, outside Terraform):
# 1. Create (or identify) a CloudWatch Logs log group, e.g. /aws/bedrock/modelinvocations.
# 2. Create an IAM role (e.g., Bedrock-Logging-Role) with:
#    - Trust policy allowing "bedrock.amazonaws.com" to assume the role.
#    - Permissions on the log group: logs:CreateLogStream, logs:PutLogEvents.
# 3. For each region where you use Bedrock, run (this OVERWRITES any existing config):
#    aws bedrock put-model-invocation-logging-configuration --region YOUR_REGION \
#      --logging-config '{
#        "cloudWatchConfig": {
#          "logGroupName": "/aws/bedrock/modelinvocations",
#          "roleArn": "arn:aws:iam::YOUR_ACCOUNT_ID:role/Bedrock-Logging-Role"
#        },
#        "textDataDeliveryEnabled": true,
#        "imageDataDeliveryEnabled": true,
#        "embeddingDataDeliveryEnabled": true
#      }'

# Because Terraform cannot manage this setting, `terraform plan` will show NO changes
# related to Bedrock model invocation logging. It must be verified via:
# aws bedrock get-model-invocation-logging-configuration --region YOUR_REGION