AI Security Maturity Model·AWS v1.0.0

Drag to explore · pinch to zoom
Home / Matrix / Capability 4 / c4.8
Advanced Logging and MonitoringDefense-in-depth layer: AI Application Capability 4 · ToolsUse case: AI that acts 👤 CustomerAWS Shared Responsibility Model: who implements and operates this control. Customer = you own it; AWS = AWS operates it and you inherit it; Shared = both have obligations.

c4.8 Log tool invocations with user attribution and observability

Record who invoked which tool, with what parameters, and trace tool chains, so tool misuse and anomalous behavior are detectable and auditable.

Foundational
Enhanced
Advanced
Effort: Medium Impact: Medium GenAI scopesFrom the AWS Generative AI Security Scoping Matrix.: 3 · Pre-trained models; 4 · Fine-tuned models Agentic security dimensionsFrom the AWS Agentic AI Security Scoping Matrix.: Logging & accountability, Orchestration & flow

Implementation guidance

How to implement on AWS

Enable CloudTrail (organization trail) to log tool invocations with user-context attribution and forward to the Log Archive account. Monitor invocation rates, duration, and failures with CloudWatch alarms. Use AgentCore Observability to trace tool chains and multi-agent workflows; for OS tools, log via Systems Manager Session Manager.

Acceptance criteria

Tool invocations are logged with user attribution and centralized; CloudWatch alarms on anomalous tool metrics; tool-chain traces are available.

Practical implementation

How this control is implemented in each reference architecture:

Tool invocations are logged with user attribution via the org CloudTrail to the Log archive, AgentCore Observability traces tool chains, and CloudWatch alarms on anomalies.

  1. Enable the organization CloudTrail to log tool invocations with user-context attribution and forward to the Log archive account.
    Generative AI account → Log archive CloudTrail Amazon S3
  2. Use AgentCore Observability to trace tool chains and multi-agent workflows; for OS-level tools log via Systems Manager Session Manager.
    Generative AI account AgentCore Observability Systems Manager
  3. Alarm in CloudWatch on invocation rate, duration, and failure anomalies for tools.
    Generative AI account CloudWatch

How to validate: Tool invocations are logged with user attribution and centralized in the Log archive; CloudWatch alarms on anomalous tool metrics; tool-chain traces are available.

Avoid: Logging that a tool ran but not who triggered it or with what parameters. Without user attribution you cannot investigate tool misuse.

Generative AI OU (multi-account) →

In-account CloudTrail with user attribution, AgentCore Observability tracing, and CloudWatch anomaly alarms make tool misuse detectable and auditable.

  1. Log tool invocations with user-context attribution via CloudTrail into the in-account Object-Lock log bucket.
    In-account logging CloudTrail Amazon S3
  2. Trace tool chains with AgentCore Observability; log OS-level tools via Systems Manager Session Manager.
    In-account logging AgentCore Observability Systems Manager
  3. Alarm on anomalous tool invocation rate, duration, and failures in CloudWatch.
    In-account logging CloudWatch

How to validate: Tool invocations are logged with user attribution; CloudWatch alarms on anomalous tool metrics; tool-chain traces are available.

Avoid: No trace across a multi-step tool chain. Capture the chain so an anomalous sequence of tool calls can be reconstructed.

Single account (entry point) →

Threats addressed

  • Tool misuse or anomalous invocation patterns going undetected.
  • No audit trail attributing a tool action to a user.

AWS services

AWS CloudTrail Amazon CloudWatch Amazon Bedrock AgentCore Observability

Framework mappings

OWASP GenAI/LLM Top 10 (2026)

  • LLM03 Excessive Agency
  • LLM06 Unbounded Consumption

NIST AI Risk Management Framework (AI 100-1)

  • MEASURE.3 Mechanisms for tracking AI risks are in place
  • MANAGE.4 Risk treatments, monitoring and response are documented and applied

AWS Security Hub — AI Security Best Practices

  • BedrockAgentCore.6 Bedrock AgentCore custom browsers should have session recording enabled

AWS Well-Architected Generative AI Lens (Security)

  • GENSEC03-BP01 Implement control plane and data access monitoring

OWASP GenAI Top 10 for Agentic Applications (2025)

  • ASI08 Cascading Failures

Learning resources

References

  • AWS SRA for AI — Capability 4, Logging and monitoring