Exam-style
An auditor wants to read the full text of every prompt and every completion a Bedrock-backed assistant handled last Tuesday. The application logs hold request IDs, token counts, and latency, but no message content. What produces the record the auditor wants?
Reveal the answer
E. Bedrock model invocation logging, enabled per region and delivering request and response payloads to S3 or CloudWatch Logs
Model invocation logging is the only feature that persists the actual prompt and completion payloads. You choose which modalities it captures (text, image, embedding, video), and it covers Converse, ConverseStream, InvokeModel and InvokeModelWithResponseStream. It is off by default and configured per region, so it has to be switched on ahead of the request. Bodies over 100 KB and binary data are written to S3 as separate objects rather than inline. CloudTrail does log InvokeModel, as a management event, but the event carries only the model ID in its request parameters and a null responseElements. Container Insights measures the infrastructure, and an evaluation job scores fresh responses generated from a prompt dataset you supply, so it cannot reconstruct last Tuesday’s traffic. Agent memory is off by default and stores session summaries rather than raw payloads; Bedrock Agents Classic also entered maintenance mode on 30 July 2026, with agent creation restricted to accounts that had used it in the previous year.
Q. An auditor asks to see every prompt this assistant received last Tuesday. What produces it?
A. Bedrock model invocation logging: off by default, enabled per region, it delivers the full request and response to S3 and/or CloudWatch Logs. You pick the modalities: text, image, embedding, video. Bodies over 100 KB and binary data go to S3 as separate objects.
Why? Application logs do not carry prompts and completions, and CloudTrail records the call without the message bodies. Switch logging on in every region the model runs, before you need the record.