CloudTrail

AWS CloudTrail records API calls across an AWS account, capturing the caller identity, timestamp, source IP, and request metadata for each action. For AI workloads, Amazon Bedrock calls such as InvokeModel, ListFoundationModels, and CreateModelCustomizationJob are logged, giving compliance teams an audit trail of who invoked which model and when. CloudTrail captures the API activity, not the prompt or model output itself — that inference payload is recorded separately by Bedrock model invocation logging in CloudWatch Logs or S3. CloudTrail answers who did what and when, while CloudWatch handles operational metrics like latency and invocation counts. To prove a specific IAM user ran a Bedrock job, the answer is CloudTrail.