> ## Documentation Index
> Fetch the complete documentation index at: https://cloudanix.com/docs/llms.txt
> Use this file to discover all available pages before exploring further.

# Bedrock Service Should Enable Model Invocation Logging

### More Info:

Bedrock Service should enable model invocation logging

### Risk Level

Medium

### Address

Security

### Compliance Standards

* APRA CPS 234 (Australia)
* BSI C5 (Germany)
* Brazil LGPD
* CCPA / CPRA (California)
* CIS Critical Security Controls v8
* CMMC 2.0
* CSA Cloud Controls Matrix v4
* DPDPA
* Digital Operational Resilience Act (EU)
* ISO/IEC 27018
* ISO/IEC 27701
* MAS Technology Risk Management (Singapore)
* MITRE ATT\&CK (Cloud)
* NIST SP 800-171
* NYDFS 23 NYCRR 500
* SOC2
* SWIFT Customer Security Controls Framework
* Sarbanes-Oxley IT General Controls
* StateRAMP
* UK NCSC Cyber Assessment Framework

### Triage and Remediation

<Tabs>
  <Tab title="Remediation">
    ### Remediation

    <AccordionGroup>
      <Accordion title="Using Console" defaultOpen="true">
        Below are concise, console-based steps to enable **Model Invocation Logging** for Amazon Bedrock.

        ***

        ### 1. Prerequisites

        1. **CloudWatch log group** (optional – you can create it during setup):
           * Go to **CloudWatch → Logs → Log groups → Create log group**.
        2. **S3 bucket** for storing logs:
           * Go to **S3 → Create bucket** (or pick an existing bucket).
        3. **IAM role** for Bedrock logging (can also be auto-created):
           * Role will need permissions to:
             * `logs:CreateLogStream`, `logs:PutLogEvents` on the log group
             * `s3:PutObject` on the S3 bucket

        ***

        ### 2. Open Bedrock Model Invocation Logging

        1. In the AWS Console, go to **Amazon Bedrock**.
        2. In the left navigation pane, select **Model invocation logging** (sometimes under **Settings** or **Data and governance**, depending on the UI).

        ***

        ### 3. Enable Model Invocation Logging

        1. On the **Model invocation logging** page, choose **Enable** (or **Edit** if partially configured).
        2. Under **Logging destinations**, configure:
           * **CloudWatch Logs**:
             * Select **Enable CloudWatch Logs**.
             * Choose an existing **Log group** or create a new one.
           * **Amazon S3**:
             * Select **Enable S3 logging**.
             * Choose the **S3 bucket** and an optional prefix/folder for logs.

        ***

        ### 4. Select What to Log

        1. Under **Request logging**, choose if you want to log:
           * **Input prompts/parameters**
           * **Output responses**
           * Any specific content types (e.g., text, images), if offered.
        2. Choose **All models** or **Specific models** based on your policy.
        3. If available, configure:
           * **Redaction / anonymization** options for sensitive fields.
           * **Truncation limits** for large payloads.

        ***

        ### 5. Configure IAM Role for Logging

        1. Under **IAM role** or **Execution role**, choose:
           * **Create new role**: let Bedrock create one with the necessary permissions; or
           * **Use existing role**: select an IAM role that has:
             * Access to the specified **CloudWatch log group**.
             * Access to write logs to the **S3 bucket**.
        2. Save or apply the role selection.

        ***

        ### 6. Save and Verify

        1. Click **Save**, **Apply**, or **Enable logging** (label may vary).
        2. Test:
           * Invoke a model via the **Bedrock console playground** or your application.
           * Check:
             * **CloudWatch → Logs → Log groups → your log group → latest log stream** for entries.
             * **S3 → your bucket → prefix** for new log objects.

        ***

        Enabling this at the account/Regional level via the **Model invocation logging** settings ensures the misconfiguration (“Bedrock Service Should Enable Model Invocation Logging”) is remediated for that Region. Repeat for other Regions if required by your policy.
      </Accordion>

      <Accordion title="Using CLI">
        To enable Bedrock **model invocation logging** via AWS CLI you:

        1. **Decide where to send logs**\
           Bedrock supports three destinations (you can use one or more):

           * Amazon S3
           * CloudWatch Logs
           * Kinesis Data Firehose

           I’ll show S3 and CloudWatch Logs, which are most common.

        ***

        ## 1. Create / choose a log destination

        ### Option A – S3 bucket for logs

        ```bash theme={null}
        aws s3api create-bucket \
          --bucket my-bedrock-invocation-logs \
          --region us-east-1 \
          --create-bucket-configuration LocationConstraint=us-east-1
        ```

        (If the bucket already exists, skip.)

        ### Option B – CloudWatch Logs log group

        ```bash theme={null}
        aws logs create-log-group \
          --log-group-name /aws/bedrock/model-invocations
        ```

        ***

        ## 2. Create IAM role for Bedrock logging

        Bedrock needs an IAM role it can assume to write logs.

        ### 2.1 Trust policy

        Save as `bedrock-logging-trust.json`:

        ```json theme={null}
        {
          "Version": "2012-10-17",
          "Statement": [
            {
              "Effect": "Allow",
              "Principal": {
                "Service": "bedrock.amazonaws.com"
              },
              "Action": "sts:AssumeRole"
            }
          ]
        }
        ```

        Create the role:

        ```bash theme={null}
        aws iam create-role \
          --role-name BedrockInvocationLoggingRole \
          --assume-role-policy-document file://bedrock-logging-trust.json
        ```

        Note the returned `Arn`, e.g.:

        `arn:aws:iam::123456789012:role/BedrockInvocationLoggingRole`

        ***

        ### 2.2 Permissions policy for S3 and/or CloudWatch Logs

        Example policy for both S3 and CloudWatch Logs.\
        Adjust bucket name, region, and log group ARN.

        Save as `bedrock-logging-permissions.json`:

        ```json theme={null}
        {
          "Version": "2012-10-17",
          "Statement": [
            {
              "Sid": "S3WriteAccessForInvocationLogs",
              "Effect": "Allow",
              "Action": [
                "s3:PutObject",
                "s3:PutObjectAcl",
                "s3:GetBucketLocation"
              ],
              "Resource": [
                "arn:aws:s3:::my-bedrock-invocation-logs",
                "arn:aws:s3:::my-bedrock-invocation-logs/*"
              ]
            },
            {
              "Sid": "CloudWatchLogsAccessForInvocationLogs",
              "Effect": "Allow",
              "Action": [
                "logs:CreateLogGroup",
                "logs:CreateLogStream",
                "logs:DescribeLogGroups",
                "logs:DescribeLogStreams",
                "logs:PutLogEvents"
              ],
              "Resource": "arn:aws:logs:us-east-1:123456789012:log-group:/aws/bedrock/model-invocations:*"
            }
          ]
        }
        ```

        Attach the policy to the role:

        ```bash theme={null}
        aws iam put-role-policy \
          --role-name BedrockInvocationLoggingRole \
          --policy-name BedrockInvocationLoggingInlinePolicy \
          --policy-document file://bedrock-logging-permissions.json
        ```

        ***

        ## 3. Enable model invocation logging in Bedrock

        Use `put-model-invocation-logging-configuration`.

        Create `bedrock-logging-config.json` (S3 + CloudWatch Logs example):

        ```json theme={null}
        {
          "loggingConfig": {
            "roleArn": "arn:aws:iam::123456789012:role/BedrockInvocationLoggingRole",
            "cloudWatchConfig": {
              "logGroupName": "/aws/bedrock/model-invocations",
              "roleArn": "arn:aws:iam::123456789012:role/BedrockInvocationLoggingRole",
              "enabled": true
            },
            "s3Config": {
              "bucketName": "my-bedrock-invocation-logs",
              "textDataDeliveryEnabled": true,
              "imageDataDeliveryEnabled": true,
              "embeddingDataDeliveryEnabled": true
            },
            "kinesisFirehoseConfig": {
              "deliveryStreamArn": "",
              "textDataDeliveryEnabled": false,
              "imageDataDeliveryEnabled": false,
              "embeddingDataDeliveryEnabled": false
            }
          }
        }
        ```

        Then call:

        ```bash theme={null}
        aws bedrock put-model-invocation-logging-configuration \
          --cli-input-json file://bedrock-logging-config.json
        ```

        ***

        ## 4. Verify configuration

        ```bash theme={null}
        aws bedrock get-model-invocation-logging-configuration
        ```

        You should see your `loggingConfig` with `enabled`/delivery flags set to true. Logs will start appearing when you invoke models via Bedrock in that account/region.
      </Accordion>

      <Accordion title="Using Python">
        To remediate “Bedrock Service Should Enable Model Invocation Logging” using Python, you need to configure Bedrock’s **model invocation logging** via the `PutModelInvocationLoggingConfiguration` API (boto3: `put_model_invocation_logging_configuration`).

        Below are the step‑by‑step instructions and a minimal Python example.

        ***

        ## 1. Prerequisites

        1. **AWS Permissions**

           The IAM principal running the script needs (at minimum):

           ```json theme={null}
           {
             "Version": "2012-10-17",
             "Statement": [
               {
                 "Effect": "Allow",
                 "Action": [
                   "bedrock:PutModelInvocationLoggingConfiguration",
                   "iam:PassRole"
                 ],
                 "Resource": "*"
               }
             ]
           }
           ```

        2. **Create an IAM role for logging (if you don’t have one)**

           This role is assumed by the Bedrock service to write logs to CloudWatch and S3.

           **Trust policy (trust relationship):**

           ```json theme={null}
           {
             "Version": "2012-10-17",
             "Statement": [
               {
                 "Effect": "Allow",
                 "Principal": {
                   "Service": "bedrock.amazonaws.com"
                 },
                 "Action": "sts:AssumeRole"
               }
             ]
           }
           ```

           **Permissions policy** attached to that role (adjust ARNs as needed):

           ```json theme={null}
           {
             "Version": "2012-10-17",
             "Statement": [
               {
                 "Effect": "Allow",
                 "Action": [
                   "logs:CreateLogGroup",
                   "logs:CreateLogStream",
                   "logs:PutLogEvents",
                   "logs:DescribeLogStreams"
                 ],
                 "Resource": "*"
               },
               {
                 "Effect": "Allow",
                 "Action": [
                   "s3:PutObject",
                   "s3:AbortMultipartUpload",
                   "s3:ListBucketMultipartUploads",
                   "s3:ListBucket",
                   "s3:GetBucketLocation"
                 ],
                 "Resource": [
                   "arn:aws:s3:::YOUR-BEDROCK-LOGS-BUCKET",
                   "arn:aws:s3:::YOUR-BEDROCK-LOGS-BUCKET/*"
                 ]
               }
             ]
           }
           ```

           Note the role ARN (e.g. `arn:aws:iam::123456789012:role/bedrock-logging-role`).

        3. **Create destinations**

           * **CloudWatch Log Group** (optional but recommended):\
             e.g. `/aws/bedrock/model-invocations`
           * **S3 bucket** for logs:\
             e.g. `your-bedrock-logs-bucket` (and optional prefix, e.g. `bedrock/invocations/`)

        ***

        ## 2. Python: Enable Bedrock Model Invocation Logging

        Install boto3 if needed:

        ```bash theme={null}
        pip install boto3
        ```

        Then use this Python script (adjust ARNs, regions, bucket names):

        ```python theme={null}
        import boto3

        region = "us-east-1"  # change to your region

        bedrock_client = boto3.client("bedrock", region_name=region)

        # REQUIRED: role that Bedrock will assume to write logs
        logging_role_arn = "arn:aws:iam::123456789012:role/bedrock-logging-role"

        # OPTIONAL: CloudWatch Logs destination
        cloudwatch_log_group = "/aws/bedrock/model-invocations"

        # OPTIONAL: S3 destination
        s3_bucket_name = "your-bedrock-logs-bucket"
        s3_prefix = "bedrock/invocations/"  # optional

        # OPTIONAL: KMS key for encryption (if you use customer-managed keys)
        # kms_key_arn = "arn:aws:kms:us-east-1:123456789012:key/your-key-id"

        config = {
            "roleArn": logging_role_arn,
            "cloudWatchConfig": {
                "logGroupName": cloudwatch_log_group,
                "roleArn": logging_role_arn,
                "enabled": True
            },
            "s3Config": {
                "bucketName": s3_bucket_name,
                "prefix": s3_prefix,
                "roleArn": logging_role_arn,
                "enabled": True
            },
            # Optional: fine-grained control
            "textDataDeliveryEnabled": True,
            "imageDataDeliveryEnabled": True,
            "embeddingDataDeliveryEnabled": True
            # If using KMS:
            # "kmsKeyArn": kms_key_arn
        }

        response = bedrock_client.put_model_invocation_logging_configuration(
            loggingConfig=config
        )

        print("PutModelInvocationLoggingConfiguration response:")
        print(response)
        ```

        ***

        ## 3. Verify the Configuration

        Use:

        ```python theme={null}
        import boto3

        region = "us-east-1"
        bedrock_client = boto3.client("bedrock", region_name=region)

        resp = bedrock_client.get_model_invocation_logging_configuration()
        print(resp)
        ```

        Confirm:

        * `cloudWatchConfig.enabled` is `True` (if used)
        * `s3Config.enabled` is `True` (if used)
        * The correct `roleArn` is set
        * Test a Bedrock model invocation and check:
          * CloudWatch Logs → Log group `/aws/bedrock/model-invocations`
          * S3 → `s3://your-bedrock-logs-bucket/bedrock/invocations/`

        Enabling this configuration remediates the finding that Bedrock model invocation logging is not enabled.
      </Accordion>
    </AccordionGroup>
  </Tab>
</Tabs>