A clerk’s office needs audit-ready evidence of who changed prompt templates for the filing assistant. Which control best supports that compliance review?
Select an answer to reveal the explanation.
Short Explanation
Auditors love a guest book that shows who touched the prompt and when. CloudTrail-style logging on template changes gives the clerk’s office that guest book instead of anonymous midnight edits.
Full Explanation
Enabling CloudTrail (or equivalent audit logging) on prompt-template changes is the control that best supports a clerk’s office need for audit-ready evidence of who changed prompt templates for the filing assistant. Production prompt templates are configuration that alters resident-facing behavior; CloudTrail and related change records capture the API/console actor, time, and resource for updates to prompt stores (for example, Parameter Store, S3 objects, or Bedrock prompt management). That trail is what compliance reviewers request when reconstructing who altered filing guidance language.
Allowing anonymous edits to production prompts without recording actors destroys accountability and fails any serious compliance review. Storing the only prompt copy on a sticky note under a keyboard is not a controlled configuration store and provides no audit history. Overwriting templates in place nightly so history never accumulates actively erases the evidence trail auditors need.
Exam caveat: configuration auditability for GenAI includes prompts as governed artifacts. AWS-aligned answers commonly cite CloudTrail for who-changed-what evidence on template updates.
Operational check: store filing-assistant prompts in a versioned, access-controlled location; enable CloudTrail (and object-level or parameter logging as applicable); perform a test edit with a known IAM user; retrieve the corresponding event showing actor and time; and prohibit anonymous or local-only production prompt edits.