aws-bedrock-model-invocation-log-destination
Model invocation logging can persist full request and response data, including prompts and completions, in S3 or CloudWatch Logs.
Where it sits
| location | Configured S3/CloudWatch Bedrock model invocation log record |
|---|
| location kind | log_field |
|---|
| data kinds | credential password api_key customer_data pii source_code_secret sensitive_data |
|---|
| emits edge | ContainsSecret |
|---|
| service | Bedrock (aws:bedrock) |
|---|
Collection recipe
| access mode | indirect_destination |
|---|
| operation | GetModelInvocationLoggingConfiguration then s3:GetObject/logs:FilterLogEvents |
|---|
| response path | invocation request/response log fields |
|---|
| encoding | json |
|---|
| params | {"Destination": "\u003cconfigured-destination\u003e"} |
|---|
Required permissions
bedrock:GetModelInvocationLoggingConfiguration
s3:GetObject
References