A bank launches a Bedrock assistant that summarizes loan files, and regulators require an immutable audit trail linking every prompt, model version, and approver action for seven years with fast SQL investigations. Which audit trail management design for regulated AI workloads satisfies retention and investigation needs?
Select an answer to reveal the explanation.
Short Explanation
Regulators want a vault, not a notebook you can erase, plus a quick way to search it. Immutability is your sealed evidence bag paired with a fast index for investigators.
Full Explanation
An organization CloudTrail captures management and data events including Bedrock API calls with identity, model ID, and request metadata centrally, writing to an S3 bucket protected by Object Lock in Compliance mode with KMS encryption for tamper-evident seven-year retention, while Amazon Athena queries the locked log files in place with SQL for rapid investigations (CloudTrail Lake is closed to new customers as of May 31, 2026). The approach using VPC Flow Logs records only network 5-tuple metadata and cannot link prompts, model versions, or IAM approver context required for AI auditability. The approach using DynamoDB global tables offers flexible application storage but lacks native immutability guarantees and centralized API audit completeness, requiring custom logic to prevent tampering. The approach using CloudWatch Logs without Object Lock allows deletion or modification by privileged roles and Standard S3 without locking fails compliance immutability, plus Logs Insights retention is costlier for seven years. For the exam, remember Athena over an Object Lock archive provides audit SQL, and Object Lock Compliance mode blocks even admin deletes; in practice also enable Bedrock model invocation logging to S3 and validate trail event selectors cover data events.