AI Security Maturity Model·AWS v1.0.0

Drag to explore · pinch to zoom
Home / Matrix / Capability 5 / c5.9
Advanced Logging and MonitoringDefense-in-depth layer: AI Application Capability 5 · Generative AI agentsUse case: AI that acts 👤 CustomerAWS Shared Responsibility Model: who implements and operates this control. Customer = you own it; AWS = AWS operates it and you inherit it; Shared = both have obligations.

c5.9 Trace agent reasoning, memory, and tool chains

Capture the full decision chain (prompts, reasoning traces, memory events, tool invocations) so agent behavior is observable, auditable, and anomalies are detectable.

Foundational
Enhanced
Advanced
Effort: Medium Impact: High GenAI scopesFrom the AWS Generative AI Security Scoping Matrix.: 3 · Pre-trained models; 4 · Fine-tuned models Agentic security dimensionsFrom the AWS Agentic AI Security Scoping Matrix.: Logging & accountability, Orchestration & flow

Implementation guidance

How to implement on AWS

Enable AgentCore Observability (CloudWatch Transaction Search) to trace input/output prompts, reasoning traces, and tool invocations. Configure AgentCore Memory to emit data-plane events (CreateEvent, DeleteEvent, RetrieveMemoryRecords) to CloudWatch, alarm on anomalous tool metrics, and aggregate all agent logs to the Log Archive account.

Acceptance criteria

Reasoning traces and tool invocations are captured; memory access events are logged and audited; agent logs are centralized with anomaly alarms.

Practical implementation

How this control is implemented in each reference architecture:

AgentCore Observability traces the full decision chain in the Generative AI account, memory events are logged, and all agent logs aggregate to the Log archive with anomaly alarms.

  1. Enable AgentCore Observability (CloudWatch Transaction Search) to trace input/output prompts, reasoning traces, and tool invocations.
    Generative AI account AgentCore Observability CloudWatch
  2. Configure AgentCore Memory to emit data-plane events (CreateEvent, DeleteEvent, RetrieveMemoryRecords) to CloudWatch and alarm on anomalous tool metrics.
    Generative AI account AgentCore Memory CloudWatch
  3. Aggregate all agent logs to the Log archive account for tamper-resistant retention.
    Generative AI account → Log archive CloudTrail Amazon S3

How to validate: Reasoning traces and tool invocations are captured; memory access events are logged and audited; agent logs are centralized with anomaly alarms.

Avoid: Logging only the final answer. Without reasoning and memory-event traces you cannot reconstruct why an agent acted or detect manipulation.

Generative AI OU (multi-account) →

AgentCore Observability tracing, memory-event logging, and centralized in-account logs with anomaly alarms make agent behavior auditable.

  1. Enable AgentCore Observability to trace prompts, reasoning, and tool invocations.
    Generative AI tier (IAM role) AgentCore Observability CloudWatch
  2. Emit AgentCore Memory data-plane events to CloudWatch and alarm on anomalies.
    In-account logging AgentCore Memory CloudWatch
  3. Aggregate agent logs to the in-account Object-Lock bucket.
    In-account logging CloudTrail Amazon S3

How to validate: Reasoning traces and tool invocations are captured; memory events are logged; agent logs are centralized with anomaly alarms.

Avoid: No trace of the agent's decision chain. Capture reasoning and memory events so misbehavior is detectable and explainable.

Single account (entry point) →

Threats addressed

  • Inability to reconstruct why an agent took an action.
  • Undetected agent misbehavior or memory manipulation.

AWS services

Amazon Bedrock AgentCore Observability Amazon CloudWatch AWS CloudTrail

Framework mappings

OWASP GenAI/LLM Top 10 (2026)

  • LLM03 Excessive Agency

NIST AI Risk Management Framework (AI 100-1)

  • MEASURE.3 Mechanisms for tracking AI risks are in place
  • MANAGE.4 Risk treatments, monitoring and response are documented and applied

AWS Security Hub — AI Security Best Practices

  • BedrockAgentCore.6 Bedrock AgentCore custom browsers should have session recording enabled

AWS Well-Architected Generative AI Lens (Security)

  • GENSEC03-BP01 Implement control plane and data access monitoring

OWASP GenAI Top 10 for Agentic Applications (2025)

  • ASI08 Cascading Failures

Watch

AWS video: an introduction to Amazon Bedrock AgentCore Observability — how to capture and trace agent reasoning, memory events, and tool invocations so agent behavior is observable and auditable.

Learning resources

References

  • AWS SRA for AI — Capability 5, Logging and monitoring