A historic ice-house desk must later show what a visitor asked and what the model answered. AWS CloudTrail only shows that someone called an API. Which extra trail do they need?
Select an answer to reveal the explanation.
Short Explanation
Think of needing the actual question and answer later. CloudTrail only says someone called an API. Turn on Bedrock invocation logging to CloudWatch Logs or S3, and keep CloudTrail for who changed settings.
Full Explanation
The ice-house desk must later show what a visitor asked and what the model answered. AWS CloudTrail records that an identity called an API and often which control-plane change occurred; it does not store the conversation content. The extra trail required is Amazon Bedrock model invocation logging of prompts and completions to CloudWatch Logs or Amazon S3, kept alongside CloudTrail for who changed settings. Together they give content audit plus configuration accountability.
Relying on CloudTrail alone fails by concept: an API call is not the dialogue; you cannot reconstruct the question and answer from control-plane events. Amazon Quick alone fails because a business-intelligence chart is not an invocation log and does not retain prompt or completion payloads. A laptop chat window with no durable log fails because ephemeral UI history cannot meet later review, dispute, or incident needs.
Exam caveat: invocation logs often contain sensitive content—apply retention, access control, and encryption to the log destination, and do not confuse them with CloudTrail’s who-did-what trail. Operational check: enable Bedrock invocation logging to a locked S3 prefix or CloudWatch log group, run a test ask, confirm the prompt and completion appear in the store, and separately confirm CloudTrail shows configuration API calls for the same account.