Services or capabilities described in AWS documentation might vary by Region. To see the differences applicable to the AWS European Sovereign Cloud Region, see the AWS European Sovereign Cloud User Guide.

Monitor bedrock-mantle API calls using CloudTrail

The bedrock-mantle.region.api.aws endpoint integrates with AWS CloudTrail. CloudTrail records calls to the bedrock-mantle API operations as events, including calls from the AWS Management Console, the AWS CLI, the OpenAI SDK, the Anthropic SDK, and direct HTTPS calls. Events have an eventSource of bedrock-mantle.amazonaws.com.

If your application calls inference through bedrock-runtime.region.amazonaws.com, see Monitor Amazon Bedrock API calls using CloudTrail instead.

For background on CloudTrail itself, see the AWS CloudTrail User Guide.

Management events

Management events are logged by default to your CloudTrail Event history at no additional cost. bedrock-mantle logs the following operations as management events. The requestParameters field of each event also contains callWithBearerToken (and bearerTokenType when applicable), which are added by the service for every event.

Data events

Data events are not logged by default and incur additional CloudTrail charges. bedrock-mantle logs the following operations as data events. To capture them, configure advanced event selectors on your trail or event data store as described in Logging data events.

Configuring data event capture

The following example configures a trail to capture all bedrock-mantle inference and file data events:

aws cloudtrail put-event-selectors \
    --trail-name <trailName> \
    --advanced-event-selectors '[
      {
        "Name": "Log Bedrock Mantle inference and file events",
        "FieldSelectors": [
          { "Field": "eventCategory", "Equals": ["Data"] },
          { "Field": "resources.type", "Equals": [
            "AWS::BedrockMantle::Project",
            "AWS::BedrockMantle::CustomizedModel",
            "AWS::BedrockMantle::Reservation"
          ]}
        ]
      }
    ]'

You can additionally filter by eventName and resources.ARN. For details on advanced event selectors, see AdvancedFieldSelector.

Resource types

bedrock-mantle CloudTrail events reference the following resource types:

Example log entry

{
    "eventVersion": "1.08",
    "userIdentity": {
        "type": "IAMUser",
        "principalId": "AROAICFHPEXAMPLE",
        "arn": "arn:aws:iam::111122223333:user/userxyz",
        "accountId": "111122223333",
        "accessKeyId": "AKIAIOSFODNN7EXAMPLE",
        "userName": "userxyz"
    },
    "eventTime": "2026-05-30T14:32:11Z",
    "eventSource": "bedrock-mantle.amazonaws.com",
    "eventName": "CreateInference",
    "awsRegion": "us-east-1",
    "sourceIPAddress": "192.0.2.0",
    "userAgent": "OpenAI/Python 1.50.0",
    "requestParameters": {
        "model": "anthropic.claude-opus-4-7",
        "stream": true,
        "service_tier": "default",
        "metadata": {"team": "platform"},
        "callWithBearerToken": true,
        "bearerTokenType": "ABSK"
    },
    "responseElements": null,
    "requestID": "a1b2c3d4-5678-90ab-cdef-EXAMPLE22222",
    "eventID": "a1b2c3d4-5678-90ab-cdef-EXAMPLE11111",
    "readOnly": false,
    "eventType": "AwsApiCall",
    "managementEvent": false,
    "recipientAccountId": "111122223333",
    "eventCategory": "Data",
    "resources": [
        {
            "accountId": "111122223333",
            "type": "AWS::BedrockMantle::Project",
            "ARN": "arn:aws:bedrock-mantle:us-east-1:111122223333:project/proj_abc123"
        }
    ],
    "tlsDetails": {
        "tlsVersion": "TLSv1.3",
        "cipherSuite": "TLS_AES_128_GCM_SHA256",
        "clientProvidedHostHeader": "bedrock-mantle.us-east-1.api.aws"
    }
}

Differences from bedrock-runtime CloudTrail logging