# Memahami peristiwa Amazon Bedrock AgentCore Gateway CloudTrail
Trail adalah konfigurasi yang memungkinkan pengiriman peristiwa sebagai file log ke bucket Amazon S3 yang Anda tentukan. CloudTrail file log berisi satu atau lebih entri log. Peristiwa mewakili permintaan tunggal dari sumber manapun dan mencakup informasi seperti tindakan yang diminta, tanggal dan waktu tindakan, dan parameter permintaan.
**catatan**
Isi permintaan dan tanggapan untuk peristiwa data disunting, dan klaim JSON Web Token (JWT) memiliki entitas HTML yang disanitasi untuk tujuan keamanan.
**catatan**
Untuk peristiwa manajemen, hanya parameter permintaan yang ditentukan oleh Gateway API yang memenuhi syarat untuk redaksi. Bidang tambahan apa pun yang Anda sertakan dalam permintaan yang bukan bagian dari API dicatat CloudTrail persis seperti yang Anda kirimkan dan tidak disunting. Jangan sertakan kata sandi atau informasi sensitif lainnya di bidang yang bukan bagian dari API.
Bagian berikut menunjukkan contoh CloudTrail peristiwa:
**Topics**
+ [InvokeGateway peristiwa data dengan kesalahan otentikasi](#understanding-gateway-cloudtrail-log-entries-data-auth-error)
+ [Acara InvokeGateway data yang sukses](#understanding-gateway-cloudtrail-log-entries-data-successful)
+ [Manajemen Acara](#understanding-gateway-cloudtrail-log-entries-management)
## InvokeGateway peristiwa data dengan kesalahan otentikasi
Contoh berikut menunjukkan entri CloudTrail log yang menunjukkan `InvokeGateway` tindakan dengan kesalahan otentikasi. Kesalahan otentikasi dapat dilihat di `body` bidang. `responseElements`
```
{
"eventVersion": "1.11",
"userIdentity": {
"type": "AWSAccount",
"principalId": "",
"accountId": "anonymous"
},
"eventTime": "2025-07-14T02:14:42Z",
"eventSource": "bedrock-agentcore.amazonaws.com",
"eventName": "InvokeGateway",
"awsRegion": "us-west-2",
"sourceIPAddress": "34.XXX.XXX.206",
"userAgent": "python-httpx/0.28.1",
"requestParameters": {
"body": {
"id": 0,
"method": "initialize",
"params": {
"clientInfo": {
"name": "mcp",
"version": "0.1.0"
},
"protocolVersion": "2025-06-18",
"capabilities": {}
},
"jsonrpc": "2.0"
}
},
"responseElements": {
"body": {
"jsonrpc": "2.0",
"id": 0,
"error": {
"code": -32001,
"message": "Invalid Bearer token"
}
},
"contentType": "application/json",
"statusCode": 401
},
"requestID": "1234abcd-12ab-34cd-56ef-1234567890ab",
"eventID": "12345678-1234-5678-9abc-123456789012",
"readOnly": false,
"resources": [
{
"accountId": "XXXXXXXXXX",
"type": "AWS::BedrockAgentCore::Gateway",
"ARN": "arn:aws:bedrock-agentcore:us-west-2:XXXXXXXXXX:gateway/test-openapi-gateway-b24f8c26-u9p3rjw8qw"
}
],
"eventType": "AwsApiCall",
"managementEvent": false,
"recipientAccountId": "XXXXXXXXXX",
"sharedEventID": "12345678-xxxx-xxxx-xxxx-123456789012",
"eventCategory": "Data",
"tlsDetails": {
"tlsVersion": "TLSv1.2",
"cipherSuite": "ECDHE-RSA-AES128-GCM-SHA256",
"clientProvidedHostHeader": "test-openapi-gateway-xxxxxxx-u9p3rjw8qw.gateway.bedrock-agentcore.us-west-2.amazonaws.com"
}
}
```
## Acara InvokeGateway data yang sukses
Contoh berikut menunjukkan entri CloudTrail log untuk `InvokeGateway` tindakan yang berhasil:
```
{
"eventVersion": "1.11",
"userIdentity": {
"type": "AWSAccount",
"principalId": "",
"accountId": "anonymous"
},
"eventTime": "2025-07-14T02:14:42Z",
"eventSource": "bedrock-agentcore.amazonaws.com",
"eventName": "InvokeGateway",
"awsRegion": "us-west-2",
"sourceIPAddress": "35.88.103.184",
"userAgent": "python-httpx/0.28.1",
"requestParameters": {
"body": {
"id": 1,
"method": "tools/call",
"params": {
"name": "SmithyTarget___ListTables",
"arguments": "REDACTED"
},
"jsonrpc": "2.0"
}
},
"responseElements": {
"body": {
"jsonrpc": "2.0",
"id": 1,
"result": {
"isError": false,
"content": "REDACTED"
}
},
"contentType": "application/json",
"statusCode": 200
},
"additionalEventData": {
"targetId": "0JTXXX4YMA",
"jwt": {
"headers": {
"kid": "hGrcJwz5MX6hNeuL6jdXE4hjK7sT6oj+yN7kN+arRv4=",
"alg": "RS256"
},
"claims": {
"sub": "4ammgxxxxxxxxxxxm3b8c",
"token_use": "access",
"scope": "python-cognito-resource-server-id/write python-cognito-resource-server-id/read",
"auth_time": 1752459276,
"iss": "https://cognito-idp.us-west-2.amazonaws.com/us-west-2_Fxxxxxhtq",
"exp": 1752462876,
"iat": 1752459276,
"version": 2,
"jti": "1234abcd-12ab-34cd-56ef-1234567890ab"
},
"type": "JWS"
},
"downstreamRequestIds": [
"H3RDH6T03DG10996U0M2P1V1IFVV4KQNSO5AEMVJF66Q9ASUAAJG"
]
},
"requestID": "1234abcd-12ab-34cd-56ef-1234567890ab",
"eventID": "12345678-1234-5678-9abc-123456789012",
"readOnly": false,
"resources": [
{
"accountId": "XXXXXXXXXX",
"type": "AWS::BedrockAgentCore::Gateway",
"ARN": "arn:aws:bedrock-agentcore:us-west-2:XXXXXXXXXX:gateway/test-gateway-65129e91-mtzoadyihf"
}
],
"eventType": "AwsApiCall",
"managementEvent": false,
"recipientAccountId": "XXXXXXXXXX",
"sharedEventID": "1234abcd-12ab-34cd-56ef-1234567890ab",
"eventCategory": "Data",
"tlsDetails": {
"tlsVersion": "TLSv1.2",
"cipherSuite": "ECDHE-RSA-AES128-GCM-SHA256",
"clientProvidedHostHeader": "test-gateway-65129e91-xxxxxxxx.gateway.bedrock-agentcore.us-west-2.amazonaws.com"
}
}
```
## Manajemen Acara
Contoh berikut menunjukkan entri CloudTrail log untuk acara manajemen:
```
{
"eventVersion": "1.09",
"userIdentity": {
"type": "AssumedRole",
"principalId": "AROXXXXXXXXXXXXNRD7D:xxxxx",
"arn": "arn:aws:sts::XXXXXXXXXXXX:assumed-role/HydraInvocationRole-xxxxxxxxx/xxxx",
"accountId": "XXXXXXXXXXXX",
"accessKeyId": "xxxxxxxxx",
"sessionContext": {
"sessionIssuer": {
"type": "Role",
"principalId": "xxxxxxxx",
"arn": "arn:aws:iam::XXXXXXXXXXXX:role/HydraInvocationRole-xxx",
"accountId": "XXXXXXXXXXXX",
"userName": "HydraInvocationRole-xxxxx"
},
"attributes": {
"creationDate": "2025-07-14T02:42:43Z",
"mfaAuthenticated": "false"
}
},
"invokedBy": "bedrock-agentcore.amazonaws.com"
},
"eventTime": "2025-07-14T02:47:38Z",
"eventSource": "bedrock-agentcore.amazonaws.com",
"eventName": "CreateGateway",
"awsRegion": "us-west-2",
"sourceIPAddress": "bedrock-agentcore.amazonaws.com",
"userAgent": "bedrock-agentcore.amazonaws.com",
"requestParameters": {
"roleArn": "arn:aws:iam::XXXXXXXXXXXX:role/PythonGenesisTestGatewayRole",
"name": "***",
"authorizerConfiguration": {
"customJWTAuthorizer": {
"allowedClients": [
"xxxxxxxxx"
],
"discoveryUrl": "https://cognito-idp.us-west-2.amazonaws.com/us-west-2_xxxxx/.well-known/openid-configuration"
}
},
"description": "***",
"protocolType": "MCP",
"authorizerType": "CUSTOM_JWT"
},
"responseElements": {
"authorizerConfiguration": {
"customJWTAuthorizer": {
"allowedClients": [
"xxxxxxxxxxxxxxx"
],
"discoveryUrl": "https://cognito-idp.us-west-2.amazonaws.com/us-west-2_xxxxxx/.well-known/openid-configuration"
}
},
"description": "***",
"protocolType": "MCP",
"gatewayArn": "arn:aws:bedrock-agentcore:us-west-2:XXXXXXXXXXXX:gateway/test-openapi-gateway-xxxxxxx-xxxxxx",
"workloadIdentityDetails": {
"workloadIdentityArn": "arn:aws:bedrock-agentcore:us-west-2:XXXXXXXXXXXX:workload-identity-directory/default/workload-identity/test-openapi-gateway-xxxxxx-xxxxx"
},
"createdAt": "2025-07-14T02:47:38.302834063Z",
"gatewayUrl": "https://test-openapi-gateway-xxxxxxx-8fb4mo6pqx.gateway.bedrock-agentcore.us-west-2.amazonaws.com/mcp",
"roleArn": "arn:aws:iam::XXXXXXXXXXXX:role/PythonGenesisTestGatewayRole",
"name": "***",
"authorizerType": "CUSTOM_JWT",
"gatewayId": "test-openapi-gateway-9c8f7109-8fb4mo6pqx",
"status": "CREATING",
"updatedAt": "2025-07-14T02:47:38.302845797Z"
},
"requestID": "0fb99b0b-a4d1-xxxx-8aee-c703adaa6bd9",
"eventID": "b12bf859-xxxx-48d7-952a-d5c6ec00fb68",
"readOnly": false,
"resources": [
{
"accountId": "XXXXXXXXXXXX",
"type": "AWS::BedrockAgentCore::Gateway",
"ARN": "arn:aws:bedrock-agentcore:us-west-2:XXXXXXXXXXXX:gateway/test-openapi-gateway-xxxxxxx-8fb4mo6pqx"
}
],
"eventType": "AwsApiCall",
"managementEvent": true,
"recipientAccountId": "XXXXXXXXXXXX",
"eventCategory": "Management"
}
```