How to enable in bedrock-agentcore tracing and observability

[cronosy]

Greetings.
After I've read the documentation related to aws_bedrockagent, I could see that there isn't a way to enable observability and tracing from CDK. Also in AWS documentation, it speaks about using agentcore cli, but I'm looking for obtaining an approach directly from the IaC construct. If not possible, I'm trying to use a custom resource; however, I couldn't find a boto3 possibility. Does anybody have the same situation?
kind regards

[DYNOSuprovo]

Hi @cronosy! Observability and tracing in Amazon Bedrock Agents operates across three distinct layers (Model Invocation Logging, Action Group Lambda Tracing, and Runtime Event Tracing).

Here is how each layer is configured via AWS CDK (IaC) and the AWS SDK (Boto3):

---

Layer 1: Account-Level CloudWatch Model Logging (CDK IaC)

To capture Bedrock model prompt/response payloads and execution metadata in Amazon CloudWatch Logs directly via CDK, use the CloudFormation L1 construct CfnModelInvocationLoggingConfiguration:

import * as cdk from 'aws-cdk-lib';
import * as logs from 'aws-cdk-lib/aws-logs';
import * as iam from 'aws-cdk-lib/aws-iam';
import * as bedrock from 'aws-cdk-lib/aws-bedrock';
import { Construct } from 'constructs';

export class BedrockObservabilityStack extends cdk.Stack {
  constructor(scope: Construct, id: string, props?: cdk.StackProps) {
    super(scope, id, props);

    // 1. CloudWatch Log Group for Bedrock invocations
    const bedrockLogGroup = new logs.LogGroup(this, 'BedrockAgentLogGroup', {
      retention: logs.RetentionDays.ONE_MONTH,
      removalPolicy: cdk.RemovalPolicy.DESTROY,
    });

    // 2. IAM Role granting Bedrock service permission to write logs
    const bedrockLoggingRole = new iam.Role(this, 'BedrockLoggingRole', {
      assumedBy: new iam.ServicePrincipal('bedrock.amazonaws.com'),
    });
    bedrockLogGroup.grantWrite(bedrockLoggingRole);

    // 3. Enable Model Invocation Logging in CloudFormation
    new bedrock.CfnModelInvocationLoggingConfiguration(this, 'BedrockLoggingConfig', {
      loggingConfig: {
        cloudWatchConfig: {
          logGroupName: bedrockLogGroup.logGroupName,
          roleArn: bedrockLoggingRole.roleArn,
        },
        textDataDeliveryEnabled: true,
        imageDataDeliveryEnabled: false,
        embeddingDataDeliveryEnabled: false,
      },
    });
  }
}

---

Layer 2: Action Group Lambda Observability & AWS X-Ray (CDK)

If your Agent connects to Action Groups backed by AWS Lambda, enable AWS X-Ray active tracing and structured logging on the Lambda functions in CDK:

import * as lambda from 'aws-cdk-lib/aws-lambda';

const actionGroupFunction = new lambda.Function(this, 'AgentActionGroupFunction', {
  runtime: lambda.Runtime.PYTHON_3_12,
  handler: 'index.handler',
  code: lambda.Code.fromAsset('lambda'),
  // Enable active X-Ray tracing across Agent tool calls
  tracing: lambda.Tracing.ACTIVE,
  environment: {
    POWERTOOLS_SERVICE_NAME: 'bedrock-agent-actions',
    POWERTOOLS_LOG_LEVEL: 'INFO',
  },
});

---

Layer 3: Runtime Agent Execution Traces (Boto3 SDK)

Bedrock Agent's internal reasoning loop (Orchestration Trace, Failure Trace, Guardrail Trace, Code Interpreter Trace) is an execution-time parameter, not a static infrastructure construct property.

In Python Boto3, tracing is enabled during invocation using enableTrace=True on the bedrock-agent-runtime client:

import boto3

client = boto3.client('bedrock-agent-runtime', region_name='us-east-1')

response = client.invoke_agent(
    agentId='YOUR_AGENT_ID',
    agentAliasId='YOUR_ALIAS_ID',
    sessionId='session-123',
    inputText='What is the status of order #987?',
    enableTrace=True  # <-- Enables step-by-step reasoning & tool calling traces
)

# Consume the streaming response and trace events
for event in response.get('completion', []):
    if 'trace' in event:
        trace_data = event['trace']['trace']
        print("[AGENT TRACE]:", trace_data)
    elif 'chunk' in event:
        print("[AGENT RESPONSE]:", event['chunk']['bytes'].decode('utf-8'))

---

Layer 4: Custom Resource Alternative via Boto3

If you specifically need to configure or verify model invocation logging programmatically via a CDK Custom Resource, the Boto3 control-plane API is:

• Client: boto3.client('bedrock') (not bedrock-agent or bedrock-agent-runtime)
• Method: put_model_invocation_logging_configuration(loggingConfig={...})

However, Layer 1 (CfnModelInvocationLoggingConfiguration) is the pure CloudFormation/IaC approach and avoids needing custom Lambda wrappers.

---

If this helps you set up tracing and logging for your Bedrock agent, please feel free to mark this as the accepted answer!