Skip to main content

Cloud & OpenTelemetry

Planned

Both collectors are designed but not yet built.

Two collectors cover AI activity that no inline sensor can reach: model use inside a cloud platform, and AI systems that already emit GenAI telemetry.

AWS Bedrock ingestion​

A Python Lambda in the customer's (or Lumen's) account reads Bedrock model-invocation logs, CloudTrail and CloudWatch, normalizes each invocation into a Lumen interaction, and ships it for detection.

  • Posture: log-only. The interaction already happened by the time the log line exists, so there is no Block — detection is retroactive, findings and dashboards are the value.
  • Cross-account access uses a read-only role the customer deploys — the same shape as the other Labs services' cloud integrations: no credentials exchanged, an external-id-scoped role assumption.

OpenTelemetry receiver​

AI frameworks increasingly emit OTel GenAI semantic conventions (spans carrying gen_ai.* attributes: prompts, completions, model, token counts). The OTel collector receives OTLP, maps GenAI spans onto Lumen interactions, and runs cloud detection over them.

  • Zero code change for systems already instrumented with OTel.
  • Observability-grade coverage: Log findings, dashboards, SIEM export — not enforcement.

Where these fit​

Use cloud and OTel collectors to close the visibility gap — the platform-side AI use your inline collectors never see. For enforcement, pair them with the SDK or a gateway plugin in the request path.