Services or capabilities described in AWS documentation might vary by Region. To see the differences applicable to the AWS European Sovereign Cloud Region, see the AWS European Sovereign Cloud User Guide.

Monitor bedrock-mantle API calls using CloudTrail

The bedrock-mantle.region.api.aws endpoint integrates with AWS CloudTrail. CloudTrail records calls to the bedrock-mantle API operations as events, including calls from the AWS Management Console, the AWS CLI, the OpenAI SDK, the Anthropic SDK, and direct HTTPS calls. Events have an eventSource of bedrock-mantle.amazonaws.com.

If your application calls inference through bedrock-runtime.region.amazonaws.com, see Monitor Amazon Bedrock API calls using CloudTrail instead.

For background on CloudTrail itself, see the AWS CloudTrail User Guide.

Management events

Management events are logged by default to your CloudTrail Event history at no additional cost. bedrock-mantle logs the following operations as management events. The requestParameters field of each event also contains callWithBearerToken (and bearerTokenType when applicable), which are added by the service for every event.

In a request body, the project data-retention mode is the mode field of a data_retention object. CloudTrail records it as the flat data_retention_mode key shown in the preceding table. CreateProject records this key on every call, including calls that omit data_retention, in which case the recorded value is inherit. UpdateProject records it only when the request sets data_retention, which that operation requires you to set on its own, so data_retention_mode never appears in the same UpdateProject event as name, tags, add_tags, or remove_tag_keys.

Data events

Data events are not logged by default and incur additional CloudTrail charges. bedrock-mantle logs the following operations as data events. To capture them, configure advanced event selectors on your trail or event data store as described in Logging data events.

Configuring data event capture

The following example configures a trail to capture bedrock-mantle data events associated with a project:

aws cloudtrail put-event-selectors \
    --trail-name <trailName> \
    --advanced-event-selectors '[
      {
        "Name": "Log Bedrock Mantle project data events",
        "FieldSelectors": [
          { "Field": "eventCategory", "Equals": ["Data"] },
          { "Field": "resources.type", "Equals": ["AWS::BedrockMantle::Project"] }
        ]
      }
    ]'

You can additionally filter by eventName and resources.ARN. For details on advanced event selectors, see AdvancedFieldSelector.

Resource types

Use AWS::BedrockMantle::Project as the resources.type field selector when you configure CloudTrail data event capture for bedrock-mantle.

The resources array in a delivered event references the following resource type, which is also the only value that the resources.type field selector supports for bedrock-mantle:

Example log entry

The following example is a CreateInference data event. The eventType value AwsApiCall indicates that the event records an API call; it doesn't classify the event as a management event. The eventCategory value Data and the managementEvent value false identify it as a data event.

{
    "eventVersion": "1.08",
    "userIdentity": {
        "type": "IAMUser",
        "principalId": "AROAICFHPEXAMPLE",
        "arn": "arn:aws:iam::111122223333:user/userxyz",
        "accountId": "111122223333",
        "accessKeyId": "AKIAIOSFODNN7EXAMPLE",
        "userName": "userxyz"
    },
    "eventTime": "2026-05-30T14:32:11Z",
    "eventSource": "bedrock-mantle.amazonaws.com",
    "eventName": "CreateInference",
    "awsRegion": "us-east-1",
    "sourceIPAddress": "192.0.2.0",
    "userAgent": "OpenAI/Python 1.50.0",
    "requestParameters": {
        "model": "anthropic.claude-opus-4-7",
        "stream": true,
        "service_tier": "default",
        "metadata": {"team": "platform"},
        "callWithBearerToken": true,
        "bearerTokenType": "ABSK"
    },
    "responseElements": null,
    "requestID": "a1b2c3d4-5678-90ab-cdef-EXAMPLE22222",
    "eventID": "a1b2c3d4-5678-90ab-cdef-EXAMPLE11111",
    "readOnly": false,
    "eventType": "AwsApiCall",
    "managementEvent": false,
    "recipientAccountId": "111122223333",
    "eventCategory": "Data",
    "resources": [
        {
            "accountId": "111122223333",
            "type": "AWS::BedrockMantle::Project",
            "ARN": "arn:aws:bedrock-mantle:us-east-1:111122223333:project/proj_abc123"
        }
    ],
    "tlsDetails": {
        "tlsVersion": "TLSv1.3",
        "cipherSuite": "TLS_AES_128_GCM_SHA256",
        "clientProvidedHostHeader": "bedrock-mantle.us-east-1.api.aws"
    }
}

Differences from bedrock-runtime CloudTrail logging