Use AWS CloudTrail to record the API requests made by your AI-agent stack, then use CloudWatch AgentCore Observability when you need execution traces and performance telemetry. The essential setup is to identify each service and endpoint, distinguish management events from data events, and add data-event selectors for the resources your agents actually invoke. CloudTrail can show who called what, when, and against which resource; it is not a complete, ordered transcript of an agent’s internal reasoning.
What CloudTrail can—and cannot—show for an AI agent
CloudTrail is AWS’s audit record for monitorable API activity. An event can identify the event source, API operation, time, caller or authentication context, region, and affected resource fields. That makes it useful for questions such as:
As an Amazon Associate I earn from qualifying purchases.
- Which principal or application made an agent-related request?
- Which operation was called, and against which alias, runtime, registry, or other resource?
- When did the request occur, and in which AWS Region?
- Was the call a control-plane change or an operation on data or a running agent?
It does not provide a guaranteed, chronological trace of every internal step, prompt transformation, tool decision, or model thought. AWS states in its CloudTrail User Guide that “CloudTrail log files aren’t an ordered stack trace of the public API calls, so events don’t appear in any specific order.” Treat events as an audit record of requests, not as a replayable agent workflow.
Quick wins for a faster PC:
Repair Windows errors before they cause bigger problemsFix Now →Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →For step-level execution spans, latency, token usage, session counts, duration, and error telemetry, use AgentCore Observability in Amazon CloudWatch alongside CloudTrail. The two systems answer different operational and security questions.
#1 Best Overall
- [Ultra-Lightweight Ear Buds Designed for Small Ears] Each earbud weighs only 3.7g and features a compact, ergonomic in-ear design made especially for small ears. Secure, low-profile, and comfortable for workouts, all-day wear or overnight sleeping.The ultra-slim profile sits flush in your ear with no hard edges poking or rubbing, so you can even sleep on your side without discomfort.
- [Immersive Stereo Sound with TOZO OrigX Technology] TOZO OrigX tuning delivers clear vocals, balanced mids, and natural stereo sound for music, podcasts, and videos.
- [Long Battery Life for Daily Use] Get up to 7 hours of playtime on a single charge, with up to 32 hours total using the charging case—ideal for workdays, commuting, and extended listening sessions.
- [Bluetooth 5.3 & Stable Connection] Bluetooth 5.3 provides fast pairing, stable wireless performance, and reduced dropouts as you move around home or office.
- [Deep Bass with Clear Vocals] High-performance drivers produce punchy bass while keeping vocals clean and detailed for everyday listening.
Management events versus data events
| Event class | What it records | Default coverage | Typical agent-monitoring use |
|---|---|---|---|
| Management events | Control-plane operations such as creating, updating, configuring, or deleting AWS resources | Trails and event data stores record management events by default; recent management activity is also available in Event history | Find who changed an agent, alias, policy, runtime configuration, flow, guardrail, or related resource |
| Data events | Operations performed on or within a resource, such as invoking an agent or runtime | Not logged by default; often high volume | Capture actual agent invocations, inference calls, retrievals, gateway requests, and other runtime activity |
A trail or CloudTrail Lake event data store having management-event coverage does not mean that agent invocations are covered. Data events require explicit advanced event selectors. AWS also warns that additional charges apply to Bedrock data events, so selector scope and retention should be part of the design rather than an afterthought.
Inventory every service and endpoint in the agent path
Before changing CloudTrail, draw the request path for one representative session. Record the AWS service, endpoint, operation, resource type, and resource ARN at each hop. A single “AI agent” may involve several separately logged services.
Classic Amazon Bedrock agents
For the InvokeAgent API, AWS documents the data-event resource type AWS::Bedrock::AgentAlias. For InvokeInlineAgent, the documented resource type is AWS::Bedrock::InlineAgent. Select the type that matches the operation; selecting only a general Bedrock service source is not a substitute for selecting the required data-event resource.
Bedrock supporting operations
An agent may also retrieve from a Knowledge Base, invoke a Flow, or apply a Guardrail. These have their own documented Bedrock data-event resource types. Add only the types your application uses, and verify the current names and supported event names in the regional Bedrock documentation before saving selectors.
Bedrock Runtime and Bedrock Mantle
The endpoint matters. The bedrock-runtime endpoint records operations such as InvokeModel, Converse, and their streaming variants as management events. By contrast, inference operations through the bedrock-mantle endpoint (bedrock-mantle.amazonaws.com) are data events. Mantle uses separate resource types, so a query limited to other Bedrock event sources can miss Mantle activity.
Amazon Bedrock AgentCore
AgentCore components have distinct event names and resource types:
Rank #2
- 【IP68 Waterproof Multifunctinal Smart Watch】Torjalph fitness activity tracker smart watch is IP68 waterproof technology ,you can wear it when swimming,handwashing,it's rain-proof which means that you perform multiple exercise modes outside without worrying about sweat or rain corroding your fitness smart watch,and this watch equipped with a 230 mAh large capacity battery magnetic charging ,and this sports activity tracker watch can be used 5-7 days If fully charged.
- 【Larger 1.83'' Full Screen Watch & Multi-dial Selection】1.83 inch full HD color touch screen smart watch for men / women provides excellent 240*284 resolution image quality ,This Bluetooth smart watch offers a better touch experience and remarkable immersion and ,more than 200 watch faces for you to choose from App"Da Fit ", you can change the dial style according to your mood to wear keeping the world on your wrist
- 【Accurate Activity Tracker Smart Watch 】sports watch activity tracker uses sweat and dust resistant breathable silicone strap, our Fitness Tracker Smart Watch for Android iOS Phones supports 12 sports modes,walking,running,bicycle,swimming,badminton,basketball,football,rope skipping. This bluetooth calls smart watch for men women is lightweight and stylish, bringing more convenient and relaxing sports experience while also providing more protection.
- 【Your 24 Hour Personal Daily Health Monitor】Fitness watch for women men full touch screen IP67 waterproof bluetooth smartwatch for Android iOS Phones with heart rate blood pressure monitor multifunction Andriod smart watch with steps counter sleep monitor sports fitness watch, monitoring blood oxygen saturation allows you to understand your physical condition in real time to track fitness progress ,to know your health status in time.
- 【More Functions Bluetooth Call Smart Watch】This fitness activity smart watch full screen for iPhone and Android phones includes a bunch of new features including:The bluetooth smart watch can hang up the phone, receive and display WhatsAPP /Text /Facebook /Twitter /Messenger reminder.Support sedentary reminder, alarm clock, stopwatch, timer,weather information,music control, remote camera control compatible with Android 5.0 and above or iOS 9.0 and above smartphones.
| Component | Relevant CloudTrail distinction | Selector focus |
|---|---|---|
| AgentCore Registry | Registry data operations are data events | AWS::AgentRegistry::Registry |
| AgentCore Runtime or harness | Invocation operations are data events | AWS::BedrockAgentCore::Runtime |
| AgentCore Gateway | Gateway invocation is a separate data-event case | Use the Gateway resource type and event names documented for the deployed interface |
Do not assume that a selector for one AgentCore component covers another. Registry, runtime or harness, and Gateway activity must be mapped separately.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
Check your baseline CloudTrail collection
Use Event history for a quick management-event check
Open the AWS CloudTrail console and review Event history in the account and Region where the operation occurred. Event history is useful for confirming recent management events and for validating event names and identities during setup. It is not proof that data events are enabled.
The Agent Registry documentation states that its management events remain in Event history for 90 days (AWS documentation, 2026). That figure is specific to the cited Agent Registry page; do not generalize it to every CloudTrail collection mode or assume it replaces a trail or event data store.
Create durable delivery for investigations
For an ongoing audit record, configure a trail that delivers events to Amazon S3 or use a CloudTrail Lake event data store. Confirm the account, Regions, management-event settings, encryption, access policy, retention period, and downstream alerting. Durable delivery is important when an investigation must outlast the short Event history window or when several accounts feed a central security process.
Verify the account and Region
CloudTrail events are tied to the account and Region in which the request is recorded. Check the agent’s deployment Region, the caller’s account, and any organization-level trail or event data store before concluding that an event is missing.
Configure Bedrock agent invocation data events
The console labels and available selector fields can change. The following sequence describes the decisions to make in the CloudTrail trail or event data store configuration.
Rank #3
- [Low Noise High Fidelity] New bee guitar cord with 22AWG oxygen-free-copper center conductors provides enhanced signal transfer, the PVC insulation material and the high-density stranded copper double shield provide noise rejection for quiet operation
- [Ideal for Choice] New bee 1/4 straight and right angle metal connectors, ensures a secure connection in any instrument, pedal, or amp jack. L shape great fro on stage guitar stands
- [Wide Compatible] Suitable for mixer, power amplifier, microphone, effector, decoder, equalizer, electoronic organ, electric guitar, electric bass and other electronic equipments. Widely used in the installation of smart home, karaoke speaker, professional stage audio, etc
- [Easy Disassemble] Making incidental repairs quick and easy! Very nice, flexible cable
- [Dont Hesite to Order] 24 hours customer services and professional technology team are standing by
- Open the trail or event data store configuration. In CloudTrail, choose the existing trail or event data store that should receive the records, or create one with the required S3 or Lake retention arrangement.
- Add an advanced data-event selector. Choose data events rather than relying on the default management-event setting.
- Select the Bedrock resource type for the call. Use
AWS::Bedrock::AgentAliasforInvokeAgentandAWS::Bedrock::InlineAgentforInvokeInlineAgent. - Restrict the scope where practical. Limit by resource ARN, event name, or resource type instead of recording every eligible resource when the audit requirement is narrower.
- Add supporting Bedrock types only when needed. If the agent retrieves from a Knowledge Base, invokes a Flow, or applies a Guardrail, add the corresponding documented data-event resource type and operation.
- Save and allow delivery time. Keep the exact selector definition, destination, Region, and retention policy with the deployment record so an investigator can reproduce the coverage decision.
- Generate a known invocation. Run a test request against a specific agent alias or inline agent, recording the approximate time, account, Region, and expected resource.
- Search for the resulting event. Check the event source, event name, event category, resource type or ARN, timestamp, and identity fields. A missing event may indicate an incorrect endpoint, resource selector, Region, trail, or event-data-store scope.
Because Bedrock data events can be high volume and incur additional charges, avoid an unrestricted “all resources” selector unless the audit requirement genuinely calls for it.
Configure AgentCore coverage
Registry operations
For AgentCore Registry data operations, select the documented AWS::AgentRegistry::Registry resource type. Registry configuration changes may also appear as management events, so retain management-event coverage as well if the investigation needs both administration and use.
Runtime and harness invocations
For AgentCore Runtime or harness activity, select the data-event resource type AWS::BedrockAgentCore::Runtime and verify the invocation event names in the current AgentCore service documentation. A selector for a classic Bedrock agent alias will not automatically capture these runtime events.
Free tools Windows power users keep installed
One-click scans. No signup required.
Gateway calls and identity interpretation
Gateway invocation is another distinct data-event category. Gateway’s data API uses JWT-based authentication. Its events do not contain standard AWS identity information; instead, they record selected JWT claims, including sub. AWS recommends avoiding personally identifiable information in that claim.
Gateway event requests and responses are redacted, and these data events route only to the resource-owner account. Therefore, a Gateway event can confirm that the resource owner’s Gateway was invoked and expose the selected JWT identity context, but it should not be interpreted like an IAM-principal record from a conventional AWS API call.
Understand Bedrock endpoint coverage before investigating a gap
Endpoint confusion is a common reason for apparently incomplete logs. Build an endpoint-to-selector map for the application:
Rank #4
- Digital Family Calendar: BSIMB digital calendar wall touch screen puts an end to your chaotic life. Designed for busy families, the digital calendar keeps you organised and in step with your family. Assign different colours and tasks to each family member to make family scheduling easier and more intuitive.
- Easy Setup and Auto-Sync: Plug in, connect to WLAN and auto-syn your electric calendar in minutes. Digital wall calendar compatible with Google calendar, iCloud calendar, Outlook calendar, Cozi calendar and Yahoo calendar. Add events directly on the device or through the ecalendar app. Electronic calendar stays current whether you're at work or traveling—no manual updates needed.
- All-In-One Home Assistant: Smart calendar builds habits and encourage independence with personalised chores. Display daily meal plan to reduce the daily ‘What's for dinner?’ stress. To-do lists keep track of everything you want. Turning chores into valuable achievements with stars and rewards, making life easier and more enjoyable.
- Manage Anytime Anywhere: BSIMB electronic calendar for family stay connected with the powerful ecalendar app. Access and manage your digital wall calendar anytime, anywhere with free features like stars & rewards, photo screensaver, chore charts, meals plans, to-do lists etc. Electronic planner paid features like Magic Import tailor advanced tools for users with special needs.
- Stay in Touch with Loved Ones: Share photos or videos from your phone to electronic wall calendar with app, instantly update your life moment, and keep in touch with your family, especially those who are far away; you can also surprise your smart calendar digital wall by sending him a wish card; it's also great for keeping tech-illiterate elders in touch with the youngsters.
| Endpoint or service path | Examples | CloudTrail classification | Action |
|---|---|---|---|
bedrock-runtime |
InvokeModel, Converse, streaming variants |
Management events | Confirm management-event collection and query the correct event source |
bedrock-mantle.amazonaws.com |
Mantle inference operations | Data events | Add the Mantle resource types and event selectors explicitly |
| Bedrock agent runtime | InvokeAgent, InvokeInlineAgent |
Data events | Select the matching AgentAlias or InlineAgent resource type |
| AgentCore Runtime or harness | Runtime invocation events | Data events | Select AWS::BedrockAgentCore::Runtime and the documented event names |
When an application uses more than one path—for example, a Bedrock agent that calls a Mantle inference endpoint—each path needs its own coverage check. Searching only for “Bedrock” in a console filter can conceal the distinction between event sources and categories.
Do these 3 things before closing this tab:
1Scan for outdated or missing drivers - takes under a minute2Clear out junk files and repair common Windows errors3Fix the driver behind crashes, sound loss and screen glitchesValidate an event without treating it as a trace
Use a controlled operation to prove that the selector works:
- Choose one known resource, such as a particular agent alias, inline agent, runtime, registry, or Gateway.
- Record the invocation time in UTC, account, Region, and the expected operation name.
- Perform one request, avoiding unrelated retries or concurrent test traffic.
- Wait for the configured delivery path to make the event searchable.
- Inspect the event’s event source, event name, event category, resource type or ARN, timestamp, and identity or JWT-claim fields.
- Compare the event with the selector. If the category is data and the selector covers a different resource type, the absence is expected rather than evidence of a CloudTrail outage.
Correlate events by time, request identifiers, resource identifiers, and known session metadata where available. Do not sort the resulting records and call the result an execution stack: CloudTrail does not guarantee an ordered stack trace of public API calls.
Use CloudWatch AgentCore Observability for runtime behavior
CloudTrail answers “who requested which AWS operation, when, and against what resource?” AgentCore Observability in CloudWatch answers operational questions that CloudTrail is not designed to answer:
- Which execution spans or steps occurred during a session?
- How long did the agent or a particular operation run?
- How many tokens were used?
- How many sessions, failures, or latency outliers occurred?
- Where in the runtime did an error appear?
Use CloudTrail for identity, authorization review, change investigations, and an auditable request history. Use AgentCore Observability for traces, metrics, and runtime troubleshooting. When a security investigation needs both attribution and behavior, retain a common UTC time window and correlate the two data sets by session, resource, and request metadata rather than expecting either system to contain the other’s fields.
Recommended Free Tools
Selector scope, retention, and cost decisions
Choose the narrowest useful scope
Advanced selectors can be constrained by resource type, event name, or resource ARN. Start with the exact aliases, runtimes, registries, or gateways that must be audited. Expand only when the application’s architecture or incident-response requirements justify broader capture.
Estimate volume before enabling broad data capture
Data events are often high volume, and AWS states that additional charges apply to Bedrock data events. The final cost depends on current regional pricing, event volume, destination, and retention choices; do not use a fixed amount without checking the applicable AWS pricing page at deployment time.
Decide how long the record must survive
Event history is convenient for recent checks, while a trail or CloudTrail Lake event data store is the durable option for investigations and compliance requirements. Set retention and S3 lifecycle or Lake policies deliberately, including who can read or delete the resulting records.
Review selectors after architecture changes
Adding a Gateway, switching from a classic Bedrock agent to AgentCore, introducing Mantle, or changing an alias can move activity into a different event source or resource type. Make selector review part of the deployment checklist.
Troubleshoot missing or misleading events
No event appears after an agent invocation
- Check whether the operation is a data event; management-event coverage alone is insufficient.
- Confirm the exact endpoint, especially
bedrock-runtimeversusbedrock-mantle.amazonaws.com. - Verify that the selector uses the correct resource type:
AWS::Bedrock::AgentAlias,AWS::Bedrock::InlineAgent,AWS::BedrockAgentCore::Runtime, or the documented type for the component involved. - Check the event name, resource ARN, account, Region, trail or event data store, and delivery destination.
- Allow for delivery delay before concluding that the request was not recorded.
Only configuration changes are visible
This usually means management events are enabled but the invocation data-event selectors are not. Add the required data selectors and repeat the controlled test.
The identity does not look like an IAM principal
For AgentCore Gateway, this can be normal. Gateway data events use selected JWT claims, including sub, rather than standard AWS identity fields. Interpret the claim in the context of the Gateway’s authentication design and keep personally identifiable information out of the claim.
The records seem out of order
CloudTrail log files are not an ordered stack trace. Use timestamps and correlation fields for an approximate relationship, and move to AgentCore Observability when you need execution spans or step-level sequencing.
Records appear in the wrong account
Gateway data events route only to the resource-owner account. Check ownership as well as the caller’s account when searching for Gateway activity.
The Tool Desk
Outbyte PC Repair FREEClear out junk files and repair common Windows errorsFree Scan →Outbyte Driver Updater FREEScan for outdated or missing drivers - takes under a minuteDriver Scan →A practical monitoring checklist
- Map every agent component, endpoint, Region, account, operation, and resource ARN.
- Confirm management-event collection for configuration and control-plane changes.
- Enable only the required data-event selectors for Bedrock, Mantle, AgentCore, Knowledge Base, Flow, Guardrail, Registry, Runtime, and Gateway operations in use.
- Test one known operation and verify source, name, category, resource, time, and identity fields.
- Store events in a trail or CloudTrail Lake event data store when the record must outlast Event history.
- Review data-event volume, regional pricing, retention, encryption, and access controls.
- Use AgentCore Observability in CloudWatch for traces, latency, token usage, session counts, duration, and errors.
- Repeat the review whenever the agent architecture or endpoint changes.
Bottom line
To monitor AI agents in AWS, first identify the service and endpoint, then configure CloudTrail management events plus explicit data-event selectors for the resources that are actually invoked. Bedrock agent calls, Mantle inference, AgentCore runtime and registry operations, and Gateway invocations do not all share the same event class or resource type. CloudTrail supplies auditable request and identity context; AgentCore Observability supplies runtime traces and performance telemetry. Designing both layers together gives you evidence of who called what without mistaking an audit log for an agent’s internal execution transcript.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
