Back to Checks
aws

Amazon Bedrock model invocation logging is enabled

bedrock_model_invocation_logging_enabled
Service: bedrockSeverity: medium
OfficialBuilt-inVerified
Categories:loggingforensics-readygen-ai
Resource Type:Other

Bedrock model invocation logging captures request, response, and metadata for Converse, ConverseStream, InvokeModel, and InvokeModelWithResponseStream calls per Region, delivering records to CloudWatch Logs and/or S3 when configured.

Prowler logoProwlerprowler-provider-aws

Risk

Without invocation logs, you lose auditability and forensic visibility into model activity.

Credential misuse or prompt injection/jailbreak attempts may go unnoticed, enabling data exfiltration and unauthorized spend. Missing traceability weakens integrity controls and slows incident response.

Run this check with Prowler

Run in Prowler Cloud
Run
prowler aws --checks bedrock_model_invocation_logging_enabled

Recommendation

Enable model invocation logging and route events to CloudWatch Logs and/or S3.

Enforce least privilege on log access, use encryption, and set retention/lifecycle policies. Monitor for anomalies and alerts to support defense in depth and separation of duties.

Remediation

CLI

aws bedrock put-model-invocation-logging-configuration --logging-config '{"s3Config":{"bucketName":"<example_resource_name>"},"textDataDeliveryEnabled":true}'

Other

1Open the Amazon Bedrock console in the target Region
2Go to Settings > Model invocation logging
3Toggle Logging to On
4Select Amazon S3 as the destination and choose <example_resource_name> bucket
5Under Data types, select Text
6Click Save

Check Code

from prowler.lib.check.models import Check, Check_Report_AWS
from prowler.providers.aws.services.bedrock.bedrock_client import bedrock_client


class bedrock_model_invocation_logging_enabled(Check):
    def execute(self):
        findings = []
        for region, logging in bedrock_client.logging_configurations.items():
            report = Check_Report_AWS(metadata=self.metadata(), resource=logging)
            report.region = region
            report.resource_id = "model-invocation-logging"
            report.resource_arn = (
                bedrock_client._get_model_invocation_logging_arn_template(region)
            )
            report.status = "FAIL"
            report.status_extended = "Bedrock Model Invocation Logging is disabled."
            if logging.enabled:
                report.status = "PASS"
                report.status_extended = "Bedrock Model Invocation Logging is enabled"
                if logging.cloudwatch_log_group and logging.s3_bucket:
                    report.status_extended += f" in CloudWatch Log Group: {logging.cloudwatch_log_group} and S3 Bucket: {logging.s3_bucket}."
                elif logging.cloudwatch_log_group:
                    report.status_extended += (
                        f" in CloudWatch Log Group: {logging.cloudwatch_log_group}."
                    )
                elif logging.s3_bucket:
                    report.status_extended += f" in S3 Bucket: {logging.s3_bucket}."

            findings.append(report)

        return findings

References