Bedrock Service Should Enable Model Invocation Logging

​

1. Prerequisites

1. CloudWatch log group (optional – you can create it during setup):
   • Go to CloudWatch → Logs → Log groups → Create log group.
2. S3 bucket for storing logs:
   • Go to S3 → Create bucket (or pick an existing bucket).
3. IAM role for Bedrock logging (can also be auto-created):
   • Role will need permissions to:
     • logs:CreateLogStream, logs:PutLogEvents on the log group
     • s3:PutObject on the S3 bucket

​

2. Open Bedrock Model Invocation Logging

1. In the AWS Console, go to Amazon Bedrock.
2. In the left navigation pane, select Model invocation logging (sometimes under Settings or Data and governance, depending on the UI).

​

3. Enable Model Invocation Logging

1. On the Model invocation logging page, choose Enable (or Edit if partially configured).
2. Under Logging destinations, configure:
   • CloudWatch Logs:
     • Select Enable CloudWatch Logs.
     • Choose an existing Log group or create a new one.
   • Amazon S3:
     • Select Enable S3 logging.
     • Choose the S3 bucket and an optional prefix/folder for logs.

​

4. Select What to Log

1. Under Request logging, choose if you want to log:
   • Input prompts/parameters
   • Output responses
   • Any specific content types (e.g., text, images), if offered.
2. Choose All models or Specific models based on your policy.
3. If available, configure:
   • Redaction / anonymization options for sensitive fields.
   • Truncation limits for large payloads.

​

5. Configure IAM Role for Logging

1. Under IAM role or Execution role, choose:
   • Create new role: let Bedrock create one with the necessary permissions; or
   • Use existing role: select an IAM role that has:
     • Access to the specified CloudWatch log group.
     • Access to write logs to the S3 bucket.
2. Save or apply the role selection.

​

6. Save and Verify

1. Click Save, Apply, or Enable logging (label may vary).
2. Test:
   • Invoke a model via the Bedrock console playground or your application.
   • Check:
     • CloudWatch → Logs → Log groups → your log group → latest log stream for entries.
     • S3 → your bucket → prefix for new log objects.

1. Decide where to send logs
   Bedrock supports three destinations (you can use one or more):
   • Amazon S3
   • CloudWatch Logs
   • Kinesis Data Firehose
   I’ll show S3 and CloudWatch Logs, which are most common.

​

1. Create / choose a log destination

​

Option A – S3 bucket for logs

aws s3api create-bucket \
  --bucket my-bedrock-invocation-logs \
  --region us-east-1 \
  --create-bucket-configuration LocationConstraint=us-east-1

​

Option B – CloudWatch Logs log group

aws logs create-log-group \
  --log-group-name /aws/bedrock/model-invocations

​

2. Create IAM role for Bedrock logging

​

2.1 Trust policy

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Principal": {
        "Service": "bedrock.amazonaws.com"
      },
      "Action": "sts:AssumeRole"
    }
  ]
}

aws iam create-role \
  --role-name BedrockInvocationLoggingRole \
  --assume-role-policy-document file://bedrock-logging-trust.json

​

2.2 Permissions policy for S3 and/or CloudWatch Logs

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Sid": "S3WriteAccessForInvocationLogs",
      "Effect": "Allow",
      "Action": [
        "s3:PutObject",
        "s3:PutObjectAcl",
        "s3:GetBucketLocation"
      ],
      "Resource": [
        "arn:aws:s3:::my-bedrock-invocation-logs",
        "arn:aws:s3:::my-bedrock-invocation-logs/*"
      ]
    },
    {
      "Sid": "CloudWatchLogsAccessForInvocationLogs",
      "Effect": "Allow",
      "Action": [
        "logs:CreateLogGroup",
        "logs:CreateLogStream",
        "logs:DescribeLogGroups",
        "logs:DescribeLogStreams",
        "logs:PutLogEvents"
      ],
      "Resource": "arn:aws:logs:us-east-1:123456789012:log-group:/aws/bedrock/model-invocations:*"
    }
  ]
}

aws iam put-role-policy \
  --role-name BedrockInvocationLoggingRole \
  --policy-name BedrockInvocationLoggingInlinePolicy \
  --policy-document file://bedrock-logging-permissions.json

​

3. Enable model invocation logging in Bedrock

{
  "loggingConfig": {
    "roleArn": "arn:aws:iam::123456789012:role/BedrockInvocationLoggingRole",
    "cloudWatchConfig": {
      "logGroupName": "/aws/bedrock/model-invocations",
      "roleArn": "arn:aws:iam::123456789012:role/BedrockInvocationLoggingRole",
      "enabled": true
    },
    "s3Config": {
      "bucketName": "my-bedrock-invocation-logs",
      "textDataDeliveryEnabled": true,
      "imageDataDeliveryEnabled": true,
      "embeddingDataDeliveryEnabled": true
    },
    "kinesisFirehoseConfig": {
      "deliveryStreamArn": "",
      "textDataDeliveryEnabled": false,
      "imageDataDeliveryEnabled": false,
      "embeddingDataDeliveryEnabled": false
    }
  }
}

aws bedrock put-model-invocation-logging-configuration \
  --cli-input-json file://bedrock-logging-config.json

​

4. Verify configuration

aws bedrock get-model-invocation-logging-configuration

​

1. Prerequisites

1. AWS Permissions The IAM principal running the script needs (at minimum):
   {
     "Version": "2012-10-17",
     "Statement": [
       {
         "Effect": "Allow",
         "Action": [
           "bedrock:PutModelInvocationLoggingConfiguration",
           "iam:PassRole"
         ],
         "Resource": "*"
       }
     ]
   }
   
2. Create an IAM role for logging (if you don’t have one) This role is assumed by the Bedrock service to write logs to CloudWatch and S3. Trust policy (trust relationship):
   {
     "Version": "2012-10-17",
     "Statement": [
       {
         "Effect": "Allow",
         "Principal": {
           "Service": "bedrock.amazonaws.com"
         },
         "Action": "sts:AssumeRole"
       }
     ]
   }
   
   Permissions policy attached to that role (adjust ARNs as needed):
   {
     "Version": "2012-10-17",
     "Statement": [
       {
         "Effect": "Allow",
         "Action": [
           "logs:CreateLogGroup",
           "logs:CreateLogStream",
           "logs:PutLogEvents",
           "logs:DescribeLogStreams"
         ],
         "Resource": "*"
       },
       {
         "Effect": "Allow",
         "Action": [
           "s3:PutObject",
           "s3:AbortMultipartUpload",
           "s3:ListBucketMultipartUploads",
           "s3:ListBucket",
           "s3:GetBucketLocation"
         ],
         "Resource": [
           "arn:aws:s3:::YOUR-BEDROCK-LOGS-BUCKET",
           "arn:aws:s3:::YOUR-BEDROCK-LOGS-BUCKET/*"
         ]
       }
     ]
   }
   
   Note the role ARN (e.g. arn:aws:iam::123456789012:role/bedrock-logging-role).
3. Create destinations
   • CloudWatch Log Group (optional but recommended):
     e.g. /aws/bedrock/model-invocations
   • S3 bucket for logs:
     e.g. your-bedrock-logs-bucket (and optional prefix, e.g. bedrock/invocations/)

​

2. Python: Enable Bedrock Model Invocation Logging

pip install boto3

import boto3

region = "us-east-1"  # change to your region

bedrock_client = boto3.client("bedrock", region_name=region)

# REQUIRED: role that Bedrock will assume to write logs
logging_role_arn = "arn:aws:iam::123456789012:role/bedrock-logging-role"

# OPTIONAL: CloudWatch Logs destination
cloudwatch_log_group = "/aws/bedrock/model-invocations"

# OPTIONAL: S3 destination
s3_bucket_name = "your-bedrock-logs-bucket"
s3_prefix = "bedrock/invocations/"  # optional

# OPTIONAL: KMS key for encryption (if you use customer-managed keys)
# kms_key_arn = "arn:aws:kms:us-east-1:123456789012:key/your-key-id"

config = {
    "roleArn": logging_role_arn,
    "cloudWatchConfig": {
        "logGroupName": cloudwatch_log_group,
        "roleArn": logging_role_arn,
        "enabled": True
    },
    "s3Config": {
        "bucketName": s3_bucket_name,
        "prefix": s3_prefix,
        "roleArn": logging_role_arn,
        "enabled": True
    },
    # Optional: fine-grained control
    "textDataDeliveryEnabled": True,
    "imageDataDeliveryEnabled": True,
    "embeddingDataDeliveryEnabled": True
    # If using KMS:
    # "kmsKeyArn": kms_key_arn
}

response = bedrock_client.put_model_invocation_logging_configuration(
    loggingConfig=config
)

print("PutModelInvocationLoggingConfiguration response:")
print(response)

​

3. Verify the Configuration

import boto3

region = "us-east-1"
bedrock_client = boto3.client("bedrock", region_name=region)

resp = bedrock_client.get_model_invocation_logging_configuration()
print(resp)

• cloudWatchConfig.enabled is True (if used)
• s3Config.enabled is True (if used)
• The correct roleArn is set
• Test a Bedrock model invocation and check:
  • CloudWatch Logs → Log group /aws/bedrock/model-invocations
  • S3 → s3://your-bedrock-logs-bucket/bedrock/invocations/