Running GenAI in production brings questions like "who asked what to get this answer?", "which team uses the most tokens?", and "is any account calling an unapproved model?" AIP-C01 tests the designs that answer them in skills 3.3 (governance and compliance), 4.3 (monitoring), and 1.6.3 (prompt governance). This post maps each question to the right log, separates invocation logging from CloudTrail, and covers organization-wide enforcement and AWS AppConfig.
Which Log Answers Which Question?
| You want to know | Look at | Default | |------------------|---------|---------| | Who called which API, when | AWS CloudTrail (no prompt text) | Management events recorded by default | | What was asked and answered | Model invocation logging (bodies, token counts, caller ARN) | Disabled; you turn it on | | Slow, throttled, or costly | CloudWatch metrics | Collected automatically | | Why the agent took a step | Agent trace | Request with | | Which safety policy intervened | Guardrails trace | Request with the trace option | | Which service in the chain is slow | AWS X-Ray | Requires instrumentation |
The most tested distinction is the first two rows: auditing who called the model is CloudTrail, analyzing prompt and response content is invocation logging. CloudTrail never contains the prompt text.
!Which log answers which question?
Model Invocation Logging
Invocation logging is off by default and is configured per Region. It captures requests, responses, and metadata for , , , and , and delivers them to CloudWatch Logs, S3, or both in the same account and Region. Bodies over 100 KB and binary data go to S3 as separate objects. Each record includes and token counts, so CloudWatch Logs Insights can total tokens per caller, and a field lets callers tag requests by team or environment for cost allocation.
Because logs hold raw prompts and responses, and Guardrails masking doesn't change the logged input, encrypt the log group with KMS, restrict access, and mask PII with CloudWatch Logs data protection. Use S3 Object Lock for immutable retention and lifecycle rules to expire old logs.
CloudTrail
, , their streaming variants, and most other Bedrock APIs are management events, recorded by default. Knowledge Base and , , , and are data events that need advanced event selectors and cost extra. With cross-Region inference, the event stays in the source Region and shows where processing ran. GuardDuty analyzes CloudTrail for suspicious Bedrock activity, such as removing guardrails. For prompt governance, version prompts in Bedrock Prompt Management, keep templates in S3, and audit changes with CloudTrail.
Organization-Wide Enforcement
SCPs cap what accounts can do: deny unapproved model ARNs or Regions with . Cross-Region inference needs every destination Region allowed; global profiles need requests with set to "unspecified" allowed. The IAM condition key denies inference requests that don't use a specific guardrail, for example . Don't use such a role for or , whose internal model calls may lack the guardrail and be denied. Input tags can exclude parts of a prompt from evaluation, but the guardrail always applies to the response. Since April 2026, Bedrock policies in AWS Organizations can enforce a management-account guardrail on every model invocation in chosen OUs or accounts.
AWS AppConfig
Keep the model ID, prompt version, temperature, and fallback flags in AWS AppConfig. Lambda reads and caches them through the AppConfig extension, validators block bad configurations, and gradual deployments roll back automatically on CloudWatch alarms, so you can switch models without redeploying code.
Exam Quick Reference
"Audit who called which model API" -- AWS CloudTrail (no prompt text) "Analyze prompts, responses, and token counts" -- Model invocation logging (off by default) "Token usage per caller" -- Invocation logs + CloudWatch Logs Insights "Tag individual requests by team" -- requestMetadata "Mask PII in logs" -- CloudWatch Logs data protection "Audit Knowledge Base retrieval calls" -- CloudTrail data events "Block unapproved models or Regions across accounts" -- SCPs "Deny inference without a specific guardrail" -- bedrock:GuardrailIdentifier "Enforce one guardrail across the organization" -- Bedrock policies in AWS Organizations "Switch models without redeploying" -- AWS AppConfig