Monitor bedrock-mantle API calls using CloudTrail

The bedrock-mantle.region.api.aws endpoint integrates with AWS CloudTrail. CloudTrail records calls to the bedrock-mantle API operations as events, including calls from the AWS Management Console, the AWS CLI, the OpenAI SDK, the Anthropic SDK, and direct HTTPS calls. Events have an eventSource of bedrock-mantle.amazonaws.com.

If your application calls inference through bedrock-runtime.region.amazonaws.com, see Monitor Amazon Bedrock API calls using CloudTrail instead.

For background on CloudTrail itself, see the AWS CloudTrail User Guide.

Management events

Management events are logged by default to your CloudTrail Event history at no additional cost. bedrock-mantle logs the following operations as management events. The requestParameters field of each event also contains callWithBearerToken (and bearerTokenType when applicable), which are added by the service for every event.

Data events

Data events are not logged by default and incur additional CloudTrail charges. bedrock-mantle logs the following operations as data events. To capture them, configure advanced event selectors on your trail or event data store as described in Logging data events.

Configuring data event capture

The following example configures a trail to capture bedrock-mantle data events associated with a project:

aws cloudtrail put-event-selectors \
    --trail-name <trailName> \
    --advanced-event-selectors '[
      {
        "Name": "Log Bedrock Mantle project data events",
        "FieldSelectors": [
          { "Field": "eventCategory", "Equals": ["Data"] },
          { "Field": "resources.type", "Equals": ["AWS::BedrockMantle::Project"] }
        ]
      }
    ]'

You can additionally filter by eventName and resources.ARN. For details on advanced event selectors, see AdvancedFieldSelector.

Resource types

Use AWS::BedrockMantle::Project as the resources.type field selector when you configure CloudTrail data event capture for bedrock-mantle.

The resources array in a delivered event can reference the following resource types. Of these, only AWS::BedrockMantle::Project is supported as a value for the resources.type field selector.

Example log entry

The following example is a CreateInference data event. The eventType value AwsApiCall indicates that the event records an API call; it doesn't classify the event as a management event. The eventCategory value Data and the managementEvent value false identify it as a data event.

{
    "eventVersion": "1.08",
    "userIdentity": {
        "type": "IAMUser",
        "principalId": "AROAICFHPEXAMPLE",
        "arn": "arn:aws:iam::111122223333:user/userxyz",
        "accountId": "111122223333",
        "accessKeyId": "AKIAIOSFODNN7EXAMPLE",
        "userName": "userxyz"
    },
    "eventTime": "2026-05-30T14:32:11Z",
    "eventSource": "bedrock-mantle.amazonaws.com",
    "eventName": "CreateInference",
    "awsRegion": "us-east-1",
    "sourceIPAddress": "192.0.2.0",
    "userAgent": "OpenAI/Python 1.50.0",
    "requestParameters": {
        "model": "anthropic.claude-opus-4-7",
        "stream": true,
        "service_tier": "default",
        "metadata": {"team": "platform"},
        "callWithBearerToken": true,
        "bearerTokenType": "ABSK"
    },
    "responseElements": null,
    "requestID": "a1b2c3d4-5678-90ab-cdef-EXAMPLE22222",
    "eventID": "a1b2c3d4-5678-90ab-cdef-EXAMPLE11111",
    "readOnly": false,
    "eventType": "AwsApiCall",
    "managementEvent": false,
    "recipientAccountId": "111122223333",
    "eventCategory": "Data",
    "resources": [
        {
            "accountId": "111122223333",
            "type": "AWS::BedrockMantle::Project",
            "ARN": "arn:aws:bedrock-mantle:us-east-1:111122223333:project/proj_abc123"
        }
    ],
    "tlsDetails": {
        "tlsVersion": "TLSv1.3",
        "cipherSuite": "TLS_AES_128_GCM_SHA256",
        "clientProvidedHostHeader": "bedrock-mantle.us-east-1.api.aws"
    }
}

Differences from bedrock-runtime CloudTrail logging