Amazon Bedrock logging & audit security checks
Audit logs, event retention and incident-response hooks — the evidence you need when something goes wrong, and the controls auditors ask for first.
On Amazon Bedrock, Black Cat runs 3 checks in this area on every scan. Each one below lists its severity, how to fix it, and the compliance controls it satisfies where a control applies. See what access the Amazon Bedrock connector needs.
Checks (3)
severity: medium Bedrock Model Invocation Logging Disabled fix difficulty: easy #
Enable model invocation logging to CloudWatch or S3
- Open AWS Bedrock Console > Settings
- Enable Model invocation logging
- Choose a CloudWatch log group and/or S3 bucket destination
Satisfies: NIS2 Directive NIS2-21.b.2 DORA (SaaS Security) DORA-10.1
severity: low Bedrock Model Invocation Logging Partial fix difficulty: easy #
Enable delivery for every data type in model invocation logging
- Open AWS Bedrock Console > Settings
- Under Model invocation logging, select text, image, audio, video and embedding data types
- Save and confirm a test invocation's log record includes the input and output payloads
Satisfies: NIS2 Directive NIS2-21.b.2 DORA (SaaS Security) DORA-10.1
severity: low Bedrock AgentCore Browser Recording Disabled fix difficulty: easy #
Record browser sessions so agent browsing is auditable
- Open AWS Bedrock AgentCore Console > Built-in tools and select the browser
- Enable session recording to an S3 bucket the agents cannot write to otherwise
- Run a browser session and confirm the recording lands in the bucket
Satisfies: NIS2 Directive NIS2-21.b.2 DORA (SaaS Security) DORA-10.1