Construct Overview
The Bedrock Settings CDK L3 construct is used to configure and deploy Amazon Bedrock model invocation logging settings to S3 and/or CloudWatch.
Deployed Resources
- Bedrock Model Invocation Logging Configuration: Configures Amazon Bedrock to log model invocations to specified destinations
- S3 Bucket: (Optional) Encrypted S3 bucket for storing Bedrock model invocation audit logs
- CloudWatch Log Group: (Optional) Encrypted CloudWatch Log Group for storing Bedrock model invocation audit logs
- KMS Key: Encrypts Bedrock logging resources (S3 bucket and CloudWatch logs)
- IAM Service Role: Allows Bedrock service to write logs to CloudWatch and S3
- Custom Resource: Lambda-based custom resource that configures Bedrock logging settings via API calls
Configuration Options
- enableAuditLoggingToS3: Enable S3 bucket creation and logging for model invocation audit logs
- enableAuditLoggingToCloudwatch: Enable CloudWatch Log Group creation and logging for model invocation audit logs
At least one of these options must be enabled.
Logging Capabilities
The construct enables comprehensive logging of Bedrock model invocations including:
- Text data delivery
- Image data delivery
- Embedding data delivery
- Video data delivery
S3 Configuration
When S3 logging is enabled:
- Creates encrypted S3 bucket with naming pattern: bedrock-logs-{account}-{region}
- Logs stored with prefix: bedrock-model-invocation-logs/bedrock-model-invocation-{region}
- Bucket policy allows Bedrock service to write objects
CloudWatch Configuration
When CloudWatch logging is enabled:
- Creates encrypted CloudWatch Log Group: bedrock-model-invocation-{region}
- Infinite retention period for audit compliance
- Large data delivery fallback to S3 for oversized log entries
- Service role with permissions to write to CloudWatch Logs
Security Features
- All resources encrypted with customer-managed KMS key
- Least privilege IAM policies with resource-specific permissions
- Service principals restricted to specific account and region
- Bucket policies with condition-based access controls