A medical research company uses an Amazon Bedrock powered AI assistant with agents and knowledge bases to provide physicians quick access to medical study protocols. The company needs to generate…

Question

Options

• AUse AWS CloudTrail to log API events from generative AI workloads. Store the events in
• BUse Amazon CloudWatch to capture generative AI application logs. Stream the logs to Amazon
• CUse Amazon CloudWatch to log API events from generative AI workloads. Send the events to an
• DUse AWS CloudTrail to capture generative AI application logs. Stream the logs to Amazon

• A
  76% (16)
• B
  5% (1)
• C
  14% (3)
• D
  5% (1)

Explanation

As per AWS Cloud Operations, Bedrock, and Governance documentation, AWS CloudTrail is the authoritative service for capturing API activity and audit trails across AWS accounts. For Amazon Bedrock, CloudTrail records all user-initiated API calls, including interactions with agents, knowledge bases, and generative AI model parameters. Using CloudTrail Lake, organizations can store, query, and analyze CloudTrail events directly without needing to export data. CloudTrail Lake supports SQL-like queries for generating audit and compliance reports, enabling the company to retrieve information such as user identity, API usage, timestamp, model or agent ID, and invocation parameters. In contrast, CloudWatch focuses on operational metrics and log streaming, not API-level identity data. OpenSearch or Flink would add unnecessary complexity and cost for this use case. Thus, the AWS-recommended CloudOps best practice is to leverage CloudTrail with CloudTrail Lake to maintain auditable, queryable API activity for Bedrock workloads, fulfilling governance and compliance requirements.

No community discussion yet for this question.