Data governance is the set of decisions about how data moves through an AI system and how long it stays: where it's stored and processed, what gets logged, who watches it, and when it's deleted. For a generative AI application, that data includes training sets, documents used for retrieval, and every prompt and response. The exam expects you to know the main strategies (lifecycle, logging, residency, monitoring and retention) and which AWS features put them into practice.
Data Lifecycle
Every piece of data has a life: it's collected, stored, used, archived and eventually deleted. A governance plan decides each step in advance instead of letting data pile up. For AI, that means knowing where training data came from, how long prompts and responses are kept, and when old copies are removed. Keeping data longer than needed adds cost and risk, because anything you store can leak or be misused.
Logging AI Interactions
To show what an AI system actually did, you need a record of its inputs and outputs. Amazon Bedrock model invocation logging captures the full request, the response and metadata for model calls in an account and Region. It's turned off by default, so a team has to enable it, and it can deliver logs to Amazon S3, Amazon CloudWatch Logs or both. The destination must be in the same account and Region.
This is different from AWS CloudTrail, which records that an API call happened and who made it, but isn't where you look for the full text of every prompt and answer.
Data Residency
Residency rules say where data may be stored or processed, often within one country or region. On AWS you control this mainly by choosing the AWS Region. Cross-Region inference in Amazon Bedrock adds a choice: a geographic inference profile keeps processing inside a geography such as the US or EU, while a global profile can route requests to any supported commercial Region. Organizations with residency requirements should use geographic profiles. CloudTrail logs cross-Region requests in the source Region and records which Region processed each one.
Monitoring and Observation
Governance doesn't end at launch. Teams watch usage and behavior over time: Amazon Bedrock publishes metrics such as invocation counts, latency and input and output token counts to Amazon CloudWatch, where alarms can flag unusual spikes. Reviewing invocation logs and evaluation results over time shows whether the system still behaves as approved.
Retention
Retention sets how long each kind of data is kept, usually based on regulation or policy.
- CloudWatch Logs keeps log data indefinitely by default. You set a retention period on each log group, and older data is deleted.
- Amazon S3 Lifecycle rules move objects to cheaper storage classes after a set time and expire (delete) them when the retention period ends.
- Bedrock invocation logs stay until you delete them or the destination's own retention rules remove them, so retention has to be set at the destination.
On the Exam
If a scenario needs a full record of prompts and responses, the answer is model invocation logging, not CloudTrail alone. If it needs data processed only within a geography, look for a geographic cross-Region inference profile or a single Region. If it needs data kept for a set time and then removed, look for CloudWatch Logs retention settings or S3 Lifecycle rules rather than manual cleanup.