Exam-style
A quarterly review finds that the PII filter on a production Bedrock guardrail has been switched off for weeks. Both invocation logging and CloudTrail are enabled. Which one identifies who disabled the filter and when?
Reveal the answer
C. CloudTrail, because it records the control-plane API call that updated the guardrail with the caller identity and timestamp
CloudTrail is the record of who changed the system: control-plane calls such as UpdateGuardrail or PutModelInvocationLoggingConfiguration, each with the calling principal and a timestamp. Invocation logging answers a different question, namely what the model was asked and what it said, so it can show that filtering stopped happening but never who stopped it. Guardrail versions only capture the state of a published version, not the identity behind an edit.
Q. Who turned off the PII filter, and when? Which log, and why not invocation logging?
A. CloudTrail: it records control-plane API calls such as guardrail updates and logging-config changes, with caller identity and timestamp. Invocation logging records what the model said, not who changed the configuration.
Why? Separate the who-changed-the-system record (CloudTrail) from the what-the-model-did record (invocation logging).