AWS Collector

You can register and deploy an AIDR AWS collector to ingest Amazon Bedrock model invocation logs.

Requirements

• Subscription: AIDR for Agents

• Default roles: AIDR Admin role explicitly assigned to your Falcon user for the current customer account

• Permissions required for custom roles:

  • Manage AIDR findings and agent collectors
  • Read AIDR data from LogScale
  • Read AIDR findings and agent collectors

• CrowdStrike clouds: Available in US-1, US-2, and EU-1

• Network: HTTP access to

  AIDR origins

• AWS: Account with the necessary permissions for the following:
  • Enable Amazon Bedrock model invocation logging, configured per region.
  • Create and manage IAM roles and policies.
  • Create and configure a Lambda function.
  • Pass the Lambda execution role during function creation (iam:PassRole permission). The Lambda function runs with a minimal execution role that writes CloudWatch Logs, reads S3 objects, and writes temporary data files to the log bucket.
  • Create and configure S3 buckets and bucket notifications.

Register collector

1. On the Collectors page, click + Collector.

2. Click Logging, then click AWS, then click Next.

3. On the Add a Collector screen:

   • Collector Name - Enter a descriptive name for the collector. This name appears in dashboards and reports.
   • Logging - Select whether to log prompt data and model responses, or only metadata sent to AIDR. You can also exclude prompt content in access rule action settings .
   • Policy (optional) - Assign a policy to analyze incoming data and model responses.

   The assigned policy determines which detections run on data sent to AIDR. Policies define rules for detecting malicious activity, sensitive data exposure, topic violations, and other risks in AI interactions.

   • You can select an existing policy available for this collector type or create a policy on the Policies page.

     The selected policy name appears under the dropdown. After you save the collector registration, this label becomes a link to the corresponding policy page.

   • You can also select No Policy, Log Only. Without a policy, AIDR records activity for visibility and analysis without applying detection rules.

4. Click Save to complete collector registration.

This opens the collector details page, where you can:

• Update the collector name, logging preference, and policy assignment.
• Click the policy link to view the policy details.
• Copy credentials and AIDR base URL from the Config tab to call AIDR APIs.
• View installation instructions for the collector type on the Install tab.
• View the collector configuration activity logs.

To open the collector details page later, select your collector from the list on the Collectors page.

Deploy collector

To deploy an AWS collector, follow the instructions in the collector’s Install tab. The following sections describe additional setup details.

The AWS integration uses a Lambda function that generates pre-signed URLs for Amazon Bedrock model invocation log files stored in Amazon S3. The Lambda function sends these URLs to AIDR, which retrieves and processes the logs. Some log entries reference externally stored payload data, such as prompts or responses that exceed a size threshold. The Lambda function resolves these references and sends AIDR the full content. The resulting event data appears on the Findings and Visibility pages in the AIDR console.

The collector's Install tab includes aws CLI commands to:

1. Enable Amazon Bedrock model invocation logging to an S3 bucket.
2. Create and configure a Lambda function that forwards log references to AIDR.
3. Add an S3 trigger to invoke the Lambda function when new log files are written.

You can run these commands in environments where the aws CLI is installed and configured with the necessary permissions, or in automation workflows such as Terraform.

You can also complete this setup in the AWS Management Console.

Enable Amazon Bedrock model invocation logging to S3

1. Create an S3 bucket to store Amazon Bedrock model invocation logs. For example, s3://aidr-<aidr-organization-name>-<aidr-collector-name>-<aws-account-id>-<aws-region>/bedrock-logs.
2. In the AWS Management Console, open Amazon Bedrock and click Settings.
3. Enable Model invocation logging.
4. For the logging destination, select S3 only.
5. In the S3 location field, enter the bucket name and optional prefix.
6. Save the configuration.

Create Lambda function to forward events to AIDR

1. On the collector page in the AIDR console, click Install and download the lambda_function.zip file from the Download Lambda Function (ZIP) link.
2. In the AWS Management Console, open the Lambda service and click Create function.
3. On the Create function page:
   • Select Author from scratch.
   • Enter a Function name, for example: aidr-<aidr-organization-name>-<aidr-collector-name>-<aws-region>.
   • Select a Python version as the Runtime.
   • Under Permissions, expand Change default execution role and select Create a new role with basic Lambda permissions.
   • Click Create function.
4. On the function details page, under Code source:
   • Upload the lambda_function.zip file.
   • Add the following environment variables using values from the collector page in the AIDR console:
     • AIDR_BASE_URL - AIDR API base URL, shown in the Set Environment Variables section of the Install tab. For example, https://api.crowdstrike.com/aidr/aiguard.
     • API_KEY - Current token from the Config tab.

Add permissions to Lambda function role

When you select the Change default execution role option during Lambda function creation, AWS will do the following:

• Create an IAM role and assign it to the Lambda function.
• Add a trust policy for lambda.amazonaws.com to the role, allowing the Lambda service to assume it.
• Attach the AWSLambdaBasicExecutionRole managed policy to the role, allowing the function to write execution logs to CloudWatch.

To grant the Lambda function's pre-signed URLs access to the log bucket, add a policy to the Lambda role. Grant the following permissions on the Bedrock log bucket and prefix:

• s3:GetObject - Read from the bucket.
• s3:PutObject - Create temporary data files when bundling externally stored payload content.

On the Lambda function page:

1. Click the Configuration tab, then click Permissions in the left sidebar.

2. Click the role name to open its configuration in the IAM console.

3. In the Permissions screen, click Add permissions and create an inline policy using the following template in the JSON editor. Replace the placeholders with your S3 bucket name and prefix:

   {
     "Version": "2012-10-17",
     "Statement": [
       {
         "Effect": "Allow",
         "Action": ["s3:GetObject"],
         "Resource": ["arn:aws:s3:::<S3-bucket>/<S3-prefix>/*"]
       },
       {
         "Effect": "Allow",
         "Action": ["s3:PutObject"],
         "Resource": ["arn:aws:s3:::<S3-bucket>/<S3-prefix>/*.data.tar"]
       }
     ]
   }

note:

You can also create an IAM role in advance with the required trust and permission policies. Assign this role to the Lambda function during creation. The trust policy must allow lambda.amazonaws.com as the principal so that the Lambda service can assume the role.

Example trust policy

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Principal": {
        "Service": "lambda.amazonaws.com"
      },
      "Action": "sts:AssumeRole"
    }
  ]
}

Instead of defining permissions inline, you can create customer-managed policies and attach them to the role.

Example CloudWatch permission policy

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": "logs:CreateLogGroup",
      "Resource": "arn:aws:logs:<AWS-region>:<AWS-account-id>:*"
    },
    {
      "Effect": "Allow",
      "Action": ["logs:CreateLogStream", "logs:PutLogEvents"],
      "Resource": [
        "arn:aws:logs:<AWS-region>:<AWS-account-id>:log-group:/aws/lambda/<Lambda-function-name>:*"
      ]
    }
  ]
}

Example S3 access permission policy

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": ["s3:GetObject"],
      "Resource": ["arn:aws:s3:::<S3-bucket>/<S3-prefix>/*"]
    },
    {
      "Effect": "Allow",
      "Action": ["s3:PutObject"],
      "Resource": ["arn:aws:s3:::<S3-bucket>/<S3-prefix>/*.data.tar"]
    }
  ]
}

Add trigger to Lambda function

On the Lambda function page:

1. Click the Configuration tab, then click Triggers in the left sidebar.
2. Click Add trigger.
3. Select S3 as the trigger source.
4. In the Bucket field, select the S3 bucket you configured for Amazon Bedrock model invocation logs.
5. In the Event type field, select All object create events.
6. In the Prefix field, enter the prefix you configured for Bedrock logs; for example: bedrock-logs/.
7. In the Suffix field, enter .gz.
8. Select the checkbox under Recursive invocation to acknowledge the warning.
9. Click Add.

Test collector

To test the collector deployment, open the Amazon Bedrock service in the AWS Management Console and invoke a model in Test > Playground. If the configuration is correct, events appear on the Findings page in the AIDR console within a few minutes.

You can view the Lambda function’s invocation metrics and logs in the Monitor tab.

Troubleshooting

If new events do not appear in the AIDR console, go to the Lambda function's Monitor tab and click View logs in CloudWatch.

The CloudWatch logs show the Lambda function sending a pre-signed URL to AIDR and receiving a 202 Accepted response. If you see 403 Forbidden responses, verify that the API key and AIDR API base URL in the Lambda function's environment variables are correct.

To check the status of an asynchronous request, open the URL returned in the result.location field of the 202 response. Send a GET request and authorize it with the collector's API key as a Bearer token.

Example cURL to check request status

curl --location 'https://api.crowdstrike.com/aidr/aiguard/request/prq_dioqsgbojz5rg3xkqydahqer3vupl74i' \
--header 'Authorization: Bearer pts_xx7rw2o...iaq63oo'

Example successful response

{
  "request_id": "prq_dioqsgbojz5rg3xkqydahqer3vupl74i",
  "request_time": "2025-09-23T17:34:04.118110Z",
  "response_time": "2025-09-23T17:34:04.333419Z",
  "status": "Success",
  "summary": "Successfully processed the CSP logs",
  "result": {}
}

A Success status confirms that AIDR retrieved the logs from the pre-signed URL.