Bedrock Invocation Logging for Claude in the EU

TL;DR

Bedrock model invocation logging writes Claude prompts and answers into your AWS account. It stays off until you enable it in the source Region, typically Frankfurt. It covers bedrock-runtime only. Bodies up to 100 KB sit inline. Larger payloads go to S3. The EU profile still decides where inference runs. Set retention before the first prompt lands.

What is Bedrock model invocation logging, and what is it not?

Bedrock model invocation logging is a per-Region switch in your account. Once on, it collects request, response and metadata for supported calls in that Region. Destinations are CloudWatch Logs, S3 or both, always in the same account and Region. Model retention, the DPA and residency stay separate controls.

The AWS guide is blunt. The feature is off by default. After you enable it, logs stay until you delete the configuration. It records Converse, ConverseStream, InvokeModel and InvokeModelWithResponseStream, including the OpenAI-compatible Responses and Chat Completions APIs on bedrock-runtime. Calls through bedrock-mantle never appear.

This is not the Claude apps audit trail. The Claude Compliance API does not see Bedrock. CloudTrail records the caller, not the prompt. How the observation layers sit together is in LLM observability for Claude. The platform itself is in Amazon Bedrock in the EU.

We recommend turning it on as soon as production prompts can hold personal data. Without it you have metrics and CloudTrail, and no content.

How do you enable it in an EU source Region?

Create a log group in eu-central-1, set retention, give Bedrock an IAM role, then call PutModelInvocationLoggingConfiguration. The setting applies only to that Region. If apps call the EU profile from Ireland or Paris, repeat the steps there. Turn text on. Leave image, embedding, video and audio off until you need them.

The console path is Settings, then Model invocation logging. You pick modalities and a destination. The API exposes the same fields plus audioDataDeliveryEnabled. The CLI needs a log group name of 1 to 512 characters and a role ARN up to 2048 characters. An S3 bucket name is 3 to 63 characters. The key prefix is at most 1024.

1. Open CloudWatch in eu-central-1 and create /bedrock/invocations. You cannot rename a log group later.
2. Set retention to 30 days. The put-retention-policy reference accepts only 1, 3, 5, 7, 14, 30, 60, 90, 120, 150, 180, 365, 400, 545, 731, 1096, 1827, 2192, 2557, 2922, 3288 or 3653. With no policy, logs never expire.
3. Create an IAM role that bedrock.amazonaws.com can assume, with logs:CreateLogStream and logs:PutLogEvents on aws/bedrock/modelinvocations. Scope the trust policy to your account and eu-central-1.
4. Optional: an S3 bucket in Frankfurt for bodies over 100 KB. Disable the bucket ACL. For SSE-KMS, grant bedrock.amazonaws.com kms:GenerateDataKey.
5. Enable logging and read the configuration back.
6. Send a test call with eu.anthropic.claude-sonnet-5-5.

aws logs create-log-group --log-group-name /bedrock/invocations --region eu-central-1
aws logs put-retention-policy --log-group-name /bedrock/invocations --retention-in-days 30 --region eu-central-1
aws bedrock put-model-invocation-logging-configuration --region eu-central-1 --logging-config '{
  "cloudWatchConfig": {
    "logGroupName": "/bedrock/invocations",
    "roleArn": "arn:aws:iam::123456789012:role/BedrockInvocationLogging",
    "largeDataDeliveryS3Config": {"bucketName": "example-bedrock-logs-eu", "keyPrefix": "large"}
  },
  "textDataDeliveryEnabled": true,
  "imageDataDeliveryEnabled": false,
  "embeddingDataDeliveryEnabled": false,
  "videoDataDeliveryEnabled": false,
  "audioDataDeliveryEnabled": false
}'
aws bedrock get-model-invocation-logging-configuration --region eu-central-1

The Sonnet 5.5 card lists geo ID eu.anthropic.claude-sonnet-5-5. In-region on bedrock-runtime is N/A. From Frankfurt the destinations are Frankfurt, Stockholm, Milan, Spain, Ireland and Paris. Geographic cross-Region inference keeps processing inside the geography. Prompts can leave the source Region. Abuse-detection storage sits in the destination Region. Your invocation log stays in the source Region where you set the configuration.

Model IDs and the first call are in Claude on AWS Bedrock in the EU. The second cloud path is Claude on Vertex AI in Europe.

What lands in the log, and what is missing?

Each record is JSON with schemaType ModelInvocationLog and schemaVersion 1.0. Bedrock fills timestamp, account, Region, requestId, operation, modelId, identity.arn and token counts. Bodies up to 100 KB sit inline. Larger JSON and binary objects go to S3 under the data prefix. requestMetadata is the only field you supply.

The field table is enough for cost and incident work. Group by identity.arn in Logs Insights to see tokens per role. Converse images and documents go to S3 when image logging and S3 delivery are on. S3 writes gzipped JSON batches. CloudWatch writes one event per call.

Field	Who sets it	What it holds
identity.arn	automatic	IAM role and session
modelId	automatic	Model or profile, for example eu.anthropic.claude-sonnet-5-5
input.inputBodyJson	automatic	Prompt up to 100 KB
output.outputBodyJson	automatic	Answer up to 100 KB
Token counts	automatic	Input and output tokens
requestMetadata	caller	Optional keys such as team or ticket

Three gaps matter for EU teams. First, bedrock-mantle is absent. A single-Region mantle path gives you CloudTrail and metrics, not this log. Second, the configuration is per Region, not per profile. Third, expiry is not instant. The log group guide says deletion can take up to 72 hours. PutLogEvents rejects events more than 14 days in the past or more than 2 hours in the future.

We recommend requestMetadata with team and environment on every production call. Without those tags the only axis is the IAM ARN.

What does logging cost next to Claude?

Logging is a storage bill, not a model bill. Claude Sonnet 5.5 is 2 USD per million input tokens and 10 USD per million output tokens. Cache hits are 0.10 USD. Regional and multi-region endpoints from Sonnet 4.5 add 10 percent. Batch halves the rate to 1 and 5 USD. CloudWatch bills the gigabytes on a separate line.

Anthropic pricing covers the tokens. One CCU is 0.01 USD. One hundred CCU equal 1 USD. US-only inference is 1.1 times. The CloudWatch pricing page includes a 5 GB free tier for ingest, archive and Logs Insights scan. Its worked examples use 0.50 USD per GB ingest, 0.03 USD per GB archive and 0.12 USD per GB data protection. Prices vary by Region. A prompt with personal data turns every stored gigabyte into a GDPR record.

Item	Figure	Source
Sonnet 5.5 input / output	2 / 10 USD per million tokens	Anthropic pricing
Sonnet 5.5 cache hit	0.10 USD per million tokens (0.05x)	Anthropic pricing
Regional premium from Sonnet 4.5	10 percent	Anthropic pricing
Batch Sonnet 5.5	1 / 5 USD	Anthropic pricing
CloudWatch free tier	5 GB ingest, archive, scan	CloudWatch pricing
Example ingest / archive / masking	0.50 / 0.03 / 0.12 USD per GB	CloudWatch examples

A back-of-envelope case: 200,000 calls a month, 2,000 input and 500 output tokens on Sonnet 5.5, is 400 million input and 100 million output. That is 800 plus 1,000, or 1,800 USD in tokens. If each log event is 8 KB, you store about 1.6 GB. Under the 5 GB free tier, ingest stays at zero if you keep archive small. Claude is the expensive line. Set 30 days anyway, or the archive grows without a cap.

Cloud token rates sit in Claude API pricing in the EU. Foundry also bills in CCU and has no EU data zone. That comparison is in Azure AI Foundry in Europe.

CloudWatch, S3, Vertex or Foundry?

Use CloudWatch with 30-day retention when security and FinOps stay in the same account. Use S3 when Athena or a SIEM should read files. Use both when bodies exceed 100 KB. Vertex writes samples to BigQuery and is Preview. Foundry has diagnostic logs and no EU data zone.

Path	Destination	EU location	Prompt text	Default	Limit
Bedrock invocation logging	CloudWatch, S3 or both	Your source Region, such as Frankfurt	Yes, up to 100 KB inline	Off	bedrock-runtime only
Vertex request-response logging	BigQuery	The dataset you create	Yes, sample rate 0 to 1	Off, Preview	Pairs over 10 MB are dropped; Anthropic via REST only
Foundry diagnostic settings	Storage or Log Analytics	Your Azure geography	Request and Response Logs, up to 2 hours delay	Off	Global Standard or Data Zone Standard (US), no EU zone

Google marks request-response logging as Preview. Claude uses rawPredict and streamrawPredict. Anthropic configuration is REST only. samplingRate sits between 0 and 1. Pairs above the 10 MB BigQuery row limit are not recorded. For Claude Mythos Preview, Mythos 5 and Fable 5, Vertex can share logs with Anthropic in real time when dataSharingEnabledProvider is ANTHROPIC. That is a second recipient.

Microsoft’s diagnostic logging lists Audit Logs, Request and Response Logs, Azure OpenAI Request Usage and AllMetrics. Data can take up to two hours. The hosting comparison is unchanged: Anthropic is seller and processor. Deployment types are Global Standard and Data Zone Standard (US). There is no EU data zone.

We recommend Bedrock invocation logging in Frankfurt as the default for European teams already on the EU profile. Use Vertex only when the app already lives on Google Cloud and the dataset sits in an EU location. Skip Foundry when residency in member states is the requirement.

FAQ

Is Bedrock model invocation logging on by default in the EU?

No. AWS ships the switch off. After you enable it, logs remain until you delete the configuration. Log group retention is a separate setting. With no policy, CloudWatch keeps data indefinitely.

How much does Bedrock invocation logging cost next to Claude?

You pay Anthropic list prices for tokens. Sonnet 5.5 is 2 and 10 USD per million tokens, cache hits 0.10 USD, batch half of that. CloudWatch bills the gigabytes. The free tier is 5 GB. Pricing-page examples use 0.50 USD ingest and 0.03 USD archive. Claude remains the large line.

Bedrock invocation logging vs CloudTrail: which one do you need?

CloudTrail tells you who called which model, without the prompt. Invocation logging tells you what the prompt and the answer said. FinOps by IAM role can live on CloudTrail plus metrics. GDPR accountability and incident review need the content, so invocation logging with a short retention.

Does logging capture bedrock-mantle calls?

No. Only bedrock-runtime, including the OpenAI-compatible APIs on that endpoint. Mantle in Ireland or Stockholm needs an application log of your own. The model card lists invocation logs under bedrock-runtime features, not under mantle.

Do the logs stay in the EU when you use the EU profile?

The log sits in the source Region where you set the configuration, for example Frankfurt. The EU profile decides where inference runs. From Frankfurt that is Frankfurt, Stockholm, Milan, Spain, Ireland and Paris. Prompts can leave the source Region. Abuse-detection storage sits in the destination Region. Logging is not a residency switch.

Is Vertex request-response logging a substitute?

Only if the application already runs on Google Cloud. The feature is Preview, REST-only for Anthropic, samples into BigQuery and drops pairs over 10 MB. For Mythos and Fable 5, Google can share logs with Anthropic. Bedrock writes into your account and Region without that share switch.

Sources

1. AWS Bedrock: Model invocation logging (27 October 2026)
2. AWS Bedrock API: PutModelInvocationLoggingConfiguration (27 October 2026)
3. AWS CLI: put-model-invocation-logging-configuration (27 October 2026)
4. AWS CLI: put-retention-policy (27 October 2026)
5. AWS: CloudWatch Logs log groups (27 October 2026)
6. Amazon CloudWatch pricing (27 October 2026)
7. AWS Bedrock: Claude Sonnet 5.5 model card (27 October 2026)
8. AWS Bedrock: Geographic cross-Region inference (27 October 2026)
9. Anthropic: Pricing (27 October 2026)
10. Google Cloud: Request-response logging (27 October 2026)
11. Microsoft Learn: Claude hosting comparison (27 October 2026)
12. Microsoft Learn: Foundry diagnostic logging (27 October 2026)