Skip to Content
Getting StartedBedrock Prompt Analysis

Setup AWS Bedrock Prompt Analysis

AlertD can analyze the prompts and responses flowing through Amazon Bedrock in your account. To do this, AlertD needs to read Bedrock model invocation logs from an S3 bucket. This guide walks through the two possible situations:

  • Invocation logging is not yet enabled — turn it on and point it at the AlertD app storage bucket. AlertD’s task role already has access to that bucket, so no further permissions are needed.
  • Invocation logging is already enabled — grant the AlertD task role read access to your existing log bucket by adding a statement to that bucket’s policy.

Model invocation logging is a region-specific setting. Enable it in the same region where AlertD is deployed and where your Bedrock models are invoked.

Step 1: Check whether invocation logging is enabled

  1. Open the Amazon Bedrock console in your deployment region.
  2. In the left navigation, under Configure and learn, choose Settings.
  3. Look at the Model invocation logging section.

Amazon Bedrock Settings page with the Model invocation logging toggle turned off

  • If the Model invocation logging toggle is off, follow Path A.
  • If it is on (and already writing to an S3 bucket), follow Path B.

Path A: Enable logging to the AlertD bucket

Use this path when invocation logging is not yet enabled. You will send logs to the S3 bucket that AlertD created during deployment.

Step A1: Find the AlertD app storage bucket

  1. Open the CloudFormation console and select your AlertD stack (for example, alertd-v0-1-239).

CloudFormation Stacks list showing the AlertD stack

  1. Open the Resources tab and search for AppStorageBucket.
  2. Note the Physical ID of the AppStorageBucket resource (type AWS::S3::Bucket) — this is the bucket name, for example alertd-v0-1-239-appstoragebucket-tiepizpnv95v.

CloudFormation Resources tab filtered to AppStorageBucket

The random suffix (tiepizpnv95v) is unique to your deployment. Copy the exact value shown for your stack.

Step A2: Enable model invocation logging

  1. Return to Amazon Bedrock → Settings.
  2. Turn on the Model invocation logging toggle.
  3. Under Select the data types to include with logs, keep Text selected.
  4. Under Select the logging destinations, choose S3 only.
  5. In S3 configurations, enter the AlertD app storage bucket name you copied in Step A1.
  6. Choose Save settings.

Bedrock Settings with model invocation logging enabled, Text data type selected, and S3 only destination

Because the logs are written to the AlertD app storage bucket, AlertD’s task role already has read access. No bucket policy change is required — you’re done.

Path B: Grant the AlertD task role access to an existing bucket

Use this path when invocation logging is already enabled and writing to a bucket you manage. You will add a statement to that bucket’s policy so the AlertD task role can read the logs.

Step B1: Copy the AlertD task role ARN

  1. Open the CloudFormation console and select your AlertD stack.
  2. Open the Resources tab and search for TaskRole.
  3. Open the TaskRole resource (type AWS::IAM::Role) and copy its ARN, for example:
arn:aws:iam::837098207881:role/alertd-v0-1-239-TaskRole-p6nmqqofHyLL

CloudFormation Resources tab filtered to TaskRole

Step B2: Edit the log bucket’s policy

  1. Open the S3 console and go to the bucket that receives your Bedrock invocation logs.
  2. Open the Permissions tab and, under Bucket policy, choose Edit.

S3 bucket policy view showing an existing statement

  1. Add a new statement to the existing Statement array that grants the AlertD task role s3:GetObject and s3:ListBucket. Replace the ARNs with your task role ARN (from Step B1) and your log bucket name:
{
  "Sid": "AllowAlertDTaskRoleReadLogs",
  "Effect": "Allow",
  "Principal": {
    "AWS": "arn:aws:iam::837098207881:role/alertd-v0-1-239-TaskRole-p6nmqqofHyLL"
  },
  "Action": [
    "s3:GetObject",
    "s3:ListBucket"
  ],
  "Resource": [
    "arn:aws:s3:::YOUR-BEDROCK-LOG-BUCKET",
    "arn:aws:s3:::YOUR-BEDROCK-LOG-BUCKET/*"
  ]
}

S3 Edit bucket policy screen with the AlertD task role set as the principal

s3:ListBucket is the IAM permission that authorizes the ListObjectsV2 API call AlertD uses to enumerate log objects. It applies to the bucket ARN (no /*), while s3:GetObject applies to the object ARN (/*).

  1. Choose Save changes.

Add your statement alongside the existing statements — don’t replace them. Removing existing statements can break other access to the bucket.

Verify

Once logging is enabled and the AlertD task role has read access, AlertD begins ingesting Bedrock invocation logs on its next ingestion cycle. You can then ask questions about the prompts and responses observed in your account.

Next Steps

Last updated on
EKS MonitoringHow AlertD Works