Bedrock model invocation logging not enabled

Severity: High
Service: Bedrock
Check ID: BEDROCK_NO_LOGGING

What this check finds

Amazon Bedrock model invocation logging is not configured. Without logging, there is no audit trail of model inputs/outputs — required for compliance and forensics.

Passing looks like: Bedrock model invocation logging enabled.

How to fix it

Enable invocation logging: Bedrock console → Settings → Model invocation logging → Enable S3 logging.

Compliance controls it is evidence for

A failing result counts against these controls in KloudLytics; a passing one is evidence towards them. How compliance mapping works

Compliance controls mapped to Bedrock model invocation logging not enabled
Framework	Controls
PCI-DSS v4.0.1	10.2 Audit logs are implemented to support the detection of anomalies and suspicious activity
HIPAA Security Rule	164.312(b) Implement hardware, software, and procedural mechanisms to record activity
SOC 2 — Trust Services Criteria	CC7.2 Security Event Monitoring
NIST SP 800-53 Rev5 (Moderate)	AU-2 Event Logging AU-12 Audit Record Generation
NIST Cybersecurity Framework 2.0	PR.PS-04 Log records are generated for monitoring
ISO/IEC 27001:2022 Annex A	A.8.15 Logging

AI risk mappings

AI risk taxonomies mapped to Bedrock model invocation logging not enabled
Framework	Controls
MITRE ATLAS (Adversarial Threat Landscape for AI Systems)	AML.T0024 Exfiltration via ML Inference API

Checked on every scan

KloudLytics runs this check each time it scans a connected AWS account, through a read-only role, and lists every affected resource with its region. On Pro and Business a fix is written for the specific resource rather than the general case above. The exact access it needs

More Bedrock checks

All Bedrock checks