AWS bedrock documentation change

Service: bedrock · 2025-08-16 · Documentation medium

File: bedrock/latest/userguide/logging-using-cloudtrail.md

Summary

Expanded documentation of CloudTrail logging for Bedrock Runtime API operations, including new async/bidirectional streaming methods.

Security assessment

Adds documentation about logging additional API operations (e.g., ListAsyncInvokes, InvokeModelWithBidirectionalStream) to improve auditability. While this enhances security visibility, there is no evidence it addresses a specific security vulnerability.

Diff

diff --git a/bedrock/latest/userguide/logging-using-cloudtrail.md b/bedrock/latest/userguide/logging-using-cloudtrail.md
index ce67d62a9..7de9283c1 100644
--- a//bedrock/latest/userguide/logging-using-cloudtrail.md
+++ b//bedrock/latest/userguide/logging-using-cloudtrail.md
@@ -51 +51 @@ For more information, see the [CloudTrail userIdentity element](https://docs.aws
-Amazon Bedrock logs [Amazon Bedrock Runtime API operations](https://docs.aws.amazon.com/bedrock/latest/APIReference/API_Operations_Amazon_Bedrock_Runtime.html) (such as `InvokeModel`, `InvokeModelWithResponseStream`, `Converse`, and `ConverseStream`) as [management events](https://docs.aws.amazon.com/awscloudtrail/latest/userguide/logging-management-events-with-cloudtrail.html#logging-management-events).
+Amazon Bedrock logs some [Amazon Bedrock Runtime API operations](https://docs.aws.amazon.com/bedrock/latest/APIReference/API_Operations_Amazon_Bedrock_Runtime.html) (such as `InvokeModel`, `InvokeModelWithResponseStream`, `Converse`, `ConverseStream`, and `ListAsyncInvokes`) as [management events](https://docs.aws.amazon.com/awscloudtrail/latest/userguide/logging-management-events-with-cloudtrail.html#logging-management-events).
@@ -53 +53,3 @@ Amazon Bedrock logs [Amazon Bedrock Runtime API operations](https://docs.aws.ama
-Amazon Bedrock logs all [Agents for Amazon Bedrock Runtime API operations](https://docs.aws.amazon.com/bedrock/latest/APIReference/API_Operations_Agents_for_Amazon_Bedrock_Runtime.html) (such as `InvokeAgent` and `InvokeInlineAgent`) actions to CloudTrail as _data events_.
+Amazon Bedrock logs other [Amazon Bedrock Runtime API operations](https://docs.aws.amazon.com/bedrock/latest/APIReference/API_Operations_Amazon_Bedrock_Runtime.html) (such as `InvokeModelWithBidirectionalStream`, `GetAsyncInvoke`, and `StartAsyncInvokes`) as data events.
+
+Amazon Bedrock logs all [Agents for Amazon Bedrock Runtime API operations](https://docs.aws.amazon.com/bedrock/latest/APIReference/API_Operations_Agents_for_Amazon_Bedrock_Runtime.html) (such as `InvokeAgent` and `InvokeInlineAgent`) actions to CloudTrail as data events.
@@ -58,0 +61,4 @@ Amazon Bedrock logs all [Agents for Amazon Bedrock Runtime API operations](https
+  * To log [InvokeModelWithBidirectionalStream](https://docs.aws.amazon.com/bedrock/latest/APIReference/API_runtime_InvokeModelWithBidirectionalStream.html) calls, configure advanced event selectors to record data events for the `AWS::Bedrock::Model` resource type and `AWS:Bedrock::AsyncInvoke`.
+
+  * To log [GetAsyncInvoke](https://docs.aws.amazon.com/bedrock/latest/APIReference/API_runtime_GetAsyncInvoke.html) and [StartAsyncInvoke](https://docs.aws.amazon.com/bedrock/latest/APIReference/API_runtime_StartAsyncInvoke.html) calls, configure advanced event selectors to record data events for the `AWS::Bedrock::Model` resource type and `AWS:Bedrock::AsyncInvoke`.
+