AWS has published a reference architecture for collecting Amazon Bedrock invocation logs from multiple accounts into a central, queryable data lake.
Bedrock can already send request and response records to Amazon S3 or CloudWatch, but those logs remain separated by account. The sample uses CloudWatch subscription filters to forward records to a central account, Amazon Data Firehose to process them, and Athena to expose a combined table. Two CloudFormation templates make the deployment repeatable.
Each flattened record can include the prompt, model response, input and output token counts, model name, stop reason, timestamp, account and IAM role. The accompanying SQL can estimate per-invocation cost, helping platform teams attribute usage, investigate spikes and find responses cut short by token limits.
That visibility also creates a security obligation. Centralizing prompts and outputs may gather confidential business data or personal information in one place, so access controls, retention rules and redaction need to be designed before broad deployment. AWS provides the templates, Lambda code and queries in a sample repository; organizations remain responsible for adapting the architecture to their own data policies and account boundaries.