OneTrust AI Log Analyzer

Overview

As organizations scale AI use cases, governance teams need a “single pane of glass” to monitor risk, performance, and compliance across AI assets. The AI Log Analyzer (AILA) helps you audit AI logs stored in Amazon S3 to understand how personally identifiable information (PII) is being handled by your AI agents and models.

The AI Log Analyzer uses random sampling of available AI-generated logs and OneTrust’s classification/scanner capabilities to:

  • Detect PII in AI interaction logs stored in S3 

  • Generate key metrics per log file (e.g., PII counts, PII category) 

  • Associate findings back to specific AI agents/models within your AI governance framework

Key Benefits

Have PII scans performed out-of-band

Demonstrate to committees, auditors, and regulators in additional ways in which PII scans are being run against logs generated by agents and models. Help understand how PII consumption matches AI project use cases as defined in the AI project inventory. 

Link PII findings directly to AI agents and models

Unlike generic data discovery tools, AILA maps each metric back to a persistent AI asset identifier. This preserves historical continuity even if an agent is renamed, while using friendly names in the platform. 

Support risk and compliance reporting

View summaries of total scans and total PII found over time (e.g., daily counts, last 30/90/365 days) to help prioritize risk, respond to regulatory inquiries, and prepare materials for governance reviews. 

Strengthen AI governance with intelligence signals

Feed PII detection metrics into your broader AI governance framework so they can be combined with other risk indicators and, in later phases, drive policy rules and automated actions. 

Leverage OneTrust’s leading data classification capabilities

Reuse your existing OneTrust data classification infrastructure to extend governance from “data at rest” into AI interaction logs.

Prerequisites

  • You have access to OneTrust AI Governance with permissions to configure AI Automations. Refer to Lightweight Worker Node Deployment for AI Automations to create and deploy the lightweight worker node.

  • Amazon Bedrock invocation logging is enabled and configured to write logs to an Amazon S3 bucket. See Amazon Bedrock logging and S3 configuration.

  • The lightweight worker node has read access to the S3 bucket containing the Bedrock invocation logs. This includes the required IAM permissions, network routes, firewalls, and VPC configuration. AI Log Analyzer automatically discovers the appropriate S3 bucket and log location.

Amazon Bedrock logging and S3 configuration

To use AI Log Analyzer with Amazon Bedrock, enable invocation logging to Amazon S3 and ensure Amazon Bedrock can write logs to the target bucket. Example S3 bucket policy:

JSON 
{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Sid": "AllowBedrockWrite",
            "Effect": "Allow",
            "Principal": {
                "Service": "bedrock.amazonaws.com"
            },
            "Action": "s3:PutObject",
            "Resource": "arn:aws:s3:::bedrock-logs-bucket/*"
        }
    ]
}

The role or user that configures Amazon Bedrock logging must also be allowed to enable and view the logging configuration. Example IAM policy:

JSON 
{
    "Effect": "Allow",
    "Action": [
        "bedrock:InvokeModel",
        "bedrock:PutModelInvocationLoggingConfiguration",
        "bedrock:GetModelInvocationLoggingConfiguration"
    ],
    "Resource": "*"
}

If the S3 bucket is accessed through browser-based tools or frontend applications, configure CORS on the bucket. Example:

JSON 
[
    {
        "AllowedHeaders": [
            "*"
        ],
        "AllowedMethods": [
            "GET",
            "PUT",
            "POST"
        ],
        "AllowedOrigins": [
            "*"
        ],
        "ExposeHeaders": [
            "Access-Control-Allow-Origin"
        ]
    }
]

Supported Platforms

OneTrust AI Log Analyzer supports scanning of logs in S3 while using agents via Amazon Bedrock.

Agent-Level Visibility and Verification

To use AI Log Analyzer, administrators of OneTrust AI governance simply need to deploy a lightweight worker node through AI automations. There are no additional configurations.

Once the feature is working within AI Governance, PII/data classification metrics are surfaced directly on the agent inventory record under Details > Sensitive data classification. This permits users to:

  • Review the most recent classification data. Data displayed reflects the last 24 hours since the last sync.



  • Correlate classification results with Agent program declarations.

The details page shows the PII/Classification results from the last day, while historical data is retained in the system to support future enhancements such as trend analysis.

Known Limitations

Sampling‑based scanning

 Scans are based on a pre-configured sampling frequency rather than scanning every single log file. 

Data classification scope

 The analysis is focused solely on PII detection in AI logs and is limited to the default scan profile of the customer tenant. Custom or changing classification profiles is not supported.

Monitoring and Enforcing Thresholds

To monitor and enforce thresholds for reported metrics, it is highly encouraged to set up custom policies and track individual or groups of metrics against organizationally defined thresholds. A breach in these thresholds results in policy violations and allows deviations in a large agent inventory to surface.

For more information on creating custom policies, see AI Policies Feature Guide.