本文属于机器翻译版本。若本译文内容与英语原文存在差异，则一律以英文原文为准。

# 监控和可观测性
<a name="byo-bedrock-kb-monitoring"></a>

Amazon Bedrock 会针对您的托管知识库发出Amazon CloudTrail 数据事件`Retrieve`和 `GetDocumentContent` API 调用。您可以使用这些事件来监控成功使用情况并检测访问失败。以下演练设置了向 Amazon Logs CloudWatch 日志组传送数据事件的 CloudTrail 跟踪，然后创建指标筛选条件和警报以提醒错误。

## 第 1 步：在 Amazon CloudTrail CloudWatch 上启用 Amazon Bedrock 知识库活动
<a name="byo-bedrock-kb-monitoring-trail"></a>

设置一条 CloudTrail 跟踪以捕获 Amazon Bedrock 知识库数据事件并将其传送到 Amazon Lo CloudWatch gs 日志组。在托管知识库所在的区域中创建跟踪和日志组。您也可以通过控制台执行此操作， CloudTrail 控制台会自动创建日志组和 IAM 角色。

创建 S3 存储桶，应用允许 CloudTrail 写入的存储桶策略，然后创建 Amazon Lo CloudWatch gs 日志组：

```
aws s3 mb s3://{{YOUR_TRAIL_BUCKET}}

aws s3api put-bucket-policy --bucket {{YOUR_TRAIL_BUCKET}} --policy '{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Principal": {"Service": "cloudtrail.amazonaws.com"},
      "Action": "s3:GetBucketAcl",
      "Resource": "arn:aws:s3:::{{YOUR_TRAIL_BUCKET}}"
    },
    {
      "Effect": "Allow",
      "Principal": {"Service": "cloudtrail.amazonaws.com"},
      "Action": "s3:PutObject",
      "Resource": "arn:aws:s3:::{{YOUR_TRAIL_BUCKET}}/AWSLogs/{{ACCOUNT_ID}}/*",
      "Condition": {"StringEquals": {"s3:x-amz-acl": "bucket-owner-full-control"}}
    }
  ]
}'

aws logs create-log-group --log-group-name bedrock-kb-cloudtrail
```

创建允许 CloudTrail 向日志组传送日志的 IAM 角色：

```
aws iam create-role \
  --role-name CloudTrail-CWLogs-Role \
  --assume-role-policy-document '{
    "Version": "2012-10-17",
    "Statement": [{
      "Effect": "Allow",
      "Principal": {"Service": "cloudtrail.amazonaws.com"},
      "Action": "sts:AssumeRole"
    }]
  }'

aws iam put-role-policy \
  --role-name CloudTrail-CWLogs-Role \
  --policy-name CWLogsPolicy \
  --policy-document '{
    "Version": "2012-10-17",
    "Statement": [{
      "Effect": "Allow",
      "Action": ["logs:CreateLogStream", "logs:PutLogEvents"],
      "Resource": "arn:aws:logs:{{REGION}}:{{ACCOUNT_ID}}:log-group:bedrock-kb-cloudtrail:*"
    }]
  }'
```

创建跟踪，将其配置为捕获 Amazon Bedrock 知识库数据事件，然后开始记录：

```
aws cloudtrail create-trail \
  --name bedrock-kb-data-events \
  --s3-bucket-name {{YOUR_TRAIL_BUCKET}} \
  --cloud-watch-logs-log-group-arn "arn:aws:logs:{{REGION}}:{{ACCOUNT_ID}}:log-group:bedrock-kb-cloudtrail:*" \
  --cloud-watch-logs-role-arn "arn:aws:iam::{{ACCOUNT_ID}}:role/CloudTrail-CWLogs-Role"

aws cloudtrail put-event-selectors \
  --trail-name bedrock-kb-data-events \
  --advanced-event-selectors '[{
    "Name": "BedrockKBDataEvents",
    "FieldSelectors": [
      {"Field": "eventCategory", "Equals": ["Data"]},
      {"Field": "resources.type", "Equals": ["AWS::Bedrock::KnowledgeBase"]}
    ]
  }]'

aws cloudtrail start-logging --name bedrock-kb-data-events
```

## 第 2 步：为 Amazon 快速检索调用创建指标筛选条件
<a name="byo-bedrock-kb-monitoring-metrics"></a>

创建指标筛选条件，以便在 Amazon Quick 调用您的托管知识库时跟踪检索调用和错误。

**呼叫量指标**-跟踪您的托管知识库的检索呼叫量。

```
aws logs put-metric-filter \
  --log-group-name bedrock-kb-cloudtrail \
  --filter-name QuickSight-Retrieve-CallCount-{{KB_ID}} \
  --filter-pattern '{ $.eventSource = "bedrock.amazonaws.com" && $.eventName = "Retrieve" && $.userIdentity.invokedBy = "quicksight.amazonaws.com" && $.resources[0].ARN = "*{{KB_ID}}*" }' \
  --metric-transformations '[{
    "metricName": "RetrieveCallCount",
    "metricNamespace": "QuickSight/BedrockKB",
    "metricValue": "1",
    "dimensions": {"KnowledgeBaseId": "$.resources[0].ARN"}
  }]'
```

**错误指标** — 以下示例统计来自 Amazon Quick 但失败的`Retrieve`调用`AccessDenied`。当 Amazon Quick 服务角色缺少权限或跨账户资源策略配置错误时，会触发此警报。您可以`ThrottlingException`根据自己的监控需求为其他错误代码创建额外的指标筛选器。

```
aws logs put-metric-filter \
  --log-group-name bedrock-kb-cloudtrail \
  --filter-name QuickSight-Retrieve-AccessDenied-{{KB_ID}} \
  --filter-pattern '{ $.eventSource = "bedrock.amazonaws.com" && $.eventName = "Retrieve" && $.userIdentity.invokedBy = "quicksight.amazonaws.com" && $.resources[0].ARN = "*{{KB_ID}}*" && $.errorCode = "AccessDenied" }' \
  --metric-transformations '[{
    "metricName": "RetrieveAccessDeniedCount",
    "metricNamespace": "QuickSight/BedrockKB",
    "metricValue": "1",
    "dimensions": {"KnowledgeBaseId": "$.resources[0].ARN"}
  }]'
```

## 步骤 3：创建 CloudWatch 警报
<a name="byo-bedrock-kb-monitoring-alarm"></a>

创建在出现拒绝访问错误时触发的警报。（可选）向其中添加 SNS 主题 ARN `--alarm-actions` 以获取通知。

```
aws cloudwatch put-metric-alarm \
  --alarm-name QuickSight-Retrieve-AccessDenied-{{KB_ID}} \
  --metric-name RetrieveAccessDeniedCount \
  --namespace "QuickSight/BedrockKB" \
  --dimensions Name=KnowledgeBaseId,Value="arn:aws:bedrock:{{REGION}}:{{ACCOUNT_ID}}:knowledge-base/{{KB_ID}}" \
  --statistic Sum \
  --period 300 \
  --threshold 1 \
  --comparison-operator GreaterThanOrEqualToThreshold \
  --evaluation-periods 1 \
  --treat-missing-data notBreaching
```