Tracking Unauthorized Amazon Bedrock Access with CloudTrail

AIF-C01 By islever Editorial Last updated

Explain methods to secure AI systems.

Short answer

B Use AWS CloudTrail to record and review the API events and AccessDenied responses showing who attempted to invoke Amazon Bedrock.

Question

A security company is using Amazon Bedrock to run foundation models (FMs). The company wants to ensure that only authorized users invoke the models. The company needs to identify any unauthorized access attempts to set appropriate AWS Identity and Access Management (IAM) policies and roles for future iterations of the FMs.
Which AWS service should the company use to identify unauthorized users that are trying to access Amazon Bedrock?
  1. AWS Audit Manager
  2. AWS CloudTrail Correct Answer
  3. Amazon Fraud Detector
  4. AWS Trusted Advisor

Key Takeaways

This question tests which service provides the raw record of API activity across AWS; the trap is picking a governance or fraud tool that analyzes data rather than the service that records who called what.

To identify unauthorized users attempting to invoke Amazon Bedrock foundation models, the company should use AWS CloudTrail, which logs every AWS API call including denied requests. The CloudTrail evidence then informs the IAM policies and roles used in later iterations.

Common mistake: AWS Audit Manager (A) is the most plausible distractor because it sounds like an auditing tool, but it assesses control compliance and assembles evidence from other sources instead of being the system of record for Bedrock API calls and access denials.

Expert Analysis

The governing principle

The deciding principle here is AWS's accountability model: every API request made to an AWS service is an identity-bearing event, and the service that captures those events account-wide is AWS CloudTrail. CloudTrail records calls made through the console, SDKs, CLI and AWS service integrations, writing them to CloudTrail events — including the AccessDenied responses that signal an unauthorized attempt. Because Bedrock is invoked through API actions such as InvokeModel and InvokeModelWithResponseStream, those invocations and their denials appear as CloudTrail events with the principal, source IP, error code and request parameters attached.

Mapping the scenario onto it

The company's requirement has two parts: identify who is trying to invoke the models without authorization, and use that evidence to refine IAM policies and roles for future iterations. Both depend on a record of actual API activity. CloudTrail delivers exactly that, and its logs can be queried to find AccessDenied events on Bedrock resources, then correlated with IAM Access Analyzer or policy simulation results to close gaps. This is standard AWS guidance for auditing access to Amazon Bedrock.

Why the other options fail

  • A. AWS Audit Manager — it continuously assesses control compliance against frameworks by collecting evidence from other services; it does not serve as the primary record of who called Bedrock.
  • C. Amazon Fraud Detector — it detects online fraud in application data (payments, account takeover), not AWS API authorization events.
  • D. AWS Trusted Advisor — it reports cost, performance, security and fault-tolerance recommendations; it does not enumerate individual unauthorized invocation attempts.

So the correct choice is B. AWS CloudTrail.

Official Reference

https://docs.aws.amazon.com/bedrock/latest/userguide/security_iam_id-based-policy-examples.html

This link opens the official vendor documentation in a new tab.

Exam Strategy

On security and audit questions, look for the keyword that pins down the data source: 'who attempted an action', 'API calls', or 'access attempts' points to CloudTrail, whereas 'compliance control evidence' points to Audit Manager and 'recommendations' to Trusted Advisor. Eliminate options that analyze application data rather than AWS API activity — that immediately removes Amazon Fraud Detector — then confirm the remaining choice can log denied requests, since access denials are the evidence this scenario needs.

Frequently Asked Questions

Does AWS CloudTrail log failed or denied Amazon Bedrock invocations?

Yes. CloudTrail records the API request regardless of outcome, including error responses such as AccessDenied, so denied InvokeModel attempts appear in your event history with the principal and source details.

How do CloudTrail events help tighten IAM policies for Bedrock?

Reviewing CloudTrail shows which principals, roles and source IPs requested Bedrock actions and which were denied. You can then grant least-privilege permissions to legitimate callers and block or investigate the rest.

Which services are commonly confused with CloudTrail for this task?

AWS Audit Manager assesses control compliance and assembles evidence, Amazon Fraud Detector finds fraud in application data, and Trusted Advisor gives best-practice recommendations — none record individual Bedrock API calls.

More AIF-C01 FAQ →

Community Votes

B
100%

100% of anonymous learners picked answer B. Votes are pick records left by other test-takers — they are not the verified answer.

Discussion 9 contributions

Compiled from public community threads and reader submissions, lightly edited for clarity. Handles and vote tallies are shown as recorded, and comments reflect the views of individual contributors.

From public community threads 9

  1. Jessiii 👍 10 Answered B
    AWS CloudTrail: CloudTrail records all API requests made to AWS services, including Amazon Bedrock. By using CloudTrail, the security company can track and log all access attempts, including any unauthorized attempts, to access Amazon Bedrock. This helps the company identify and respond to unauthorized access, and also provides detailed logs for setting up appropriate IAM policies and roles.
  2. eyzzeuss 👍 4 Answered B
    AWS CloudTrail is a service that records all API calls and user activity across AWS services, including Amazon Bedrock.
  3. Moon 👍 3 Answered B
    B: AWS CloudTrail Explanation: AWS CloudTrail is a service that records all API calls and user activity across AWS services, including Amazon Bedrock. By analyzing CloudTrail logs, the company can identify unauthorized access attempts, track user activity, and audit the usage of foundation models. This information helps in setting appropriate AWS Identity and Access Management (IAM) policies and roles for future iterations of the models.
  4. jove 👍 3 Answered B
    B. AWS CloudTrail is the most suitable service for identifying unauthorized access attempts to Amazon Bedrock, as it provides detailed logging and monitoring of API calls across AWS services, helping to enforce security and compliance.
  5. 65703c1 👍 2 Answered B
    B is the correct answer
Show 4 more comments
  1. denisjtorresg 👍 1 Answered B
    Why B is correct: AWS CloudTrail is designed to record all API activity and events across your AWS infrastructure, including calls made by the AWS Management Console, AWS SDKs, command-line tools, and services like Amazon Bedrock. By reviewing CloudTrail logs, security teams can inspect denied requests, track who attempted to access specific resources, identify unauthorized users or suspicious IP addresses, and use those audit logs to refine AWS IAM policies and least-privilege roles.
  2. nandhae 👍 1 Answered B
    B. AWS CloudTrail CloudTrail records API activity and user actions in your AWS account. It logs events such as unauthorized access attempts to Amazon Bedrock and other AWS services, making it the correct choice for identifying such attempts.
  3. 85b5b55 👍 1 Answered B
    Use AWS CloudTrail to track the API Calls to AWS resources.
  4. PU-root-app 👍 1 Answered B
    B. AWS CloudTrail

Reader comments & corrections

No reader corrections yet — spotted an error or have a note? Share it below.

Log in to comment, report an error, or add a note about this question.

How to use a custom trained model in Amazon Bedrock?

S-grade

How to Increase Image Specificity in Amazon Bedrock Stable Diffusion?

S-grade

How to Quickly Deploy and Consume Foundation Models in a VPC on AWS?

S-grade

Which AWS Service Sends Email Notifications When ISV Compliance Reports Are Available?

S-grade

Practice All AIF-C01 Questions

Access 100 questions with complete answers and detailed explanations.

View Full AIF-C01 Practice Test →

← Back to AIF-C01 Study Guide