How can I audit what AWS api calls are being made by Amazon Q Developer CLI?

Hi Team,

Given These two lovely articles
https://www.404media.co/hacker-plants-computer-wiping-commands-in-amazons-ai-coding-agent/
https://www.lastweekinaws.com/blog/amazon-q-now-with-helpful-ai-powered-self-destruct-capabilities/
figured i'd ask, how can we audit what calls Amazon Q is making to the AWS API?

is it possible to add something to the "userAgent" segment that displays the amazonq cli / vscode extension and the version that its using?

For example (I know this is vscode - but I use Q CLI as well)

shows no trace of "amazon-q" anywhere in my cloudtrail event ( redacted all my info)
{ "eventVersion": "1.10", "userIdentity": { "type": "AssumedRole", "principalId": "REDACTED", "arn": "arn:aws:sts::REDACTED:assumed-role/AWSReservedSSO_AWSAdministratorAccess_REDACTED/REDACTED", "accountId": "REDACTED", "accessKeyId": "REDACTED", "sessionContext": { "sessionIssuer": { "type": "Role", "principalId": "REDACTED", "arn": "arn:aws:iam::REDACTED:role/aws-reserved/sso.amazonaws.com/ap-southeast-2/AWSReservedSSO_AWSAdministratorAccess_REDACTED", "accountId": "REDACTED", "userName": "AWSReservedSSO_AWSAdministratorAccess_REDACTED" }, "attributes": { "creationDate": "2025-07-24T05:59:42Z", "mfaAuthenticated": "false" } } }, "eventTime": "2025-07-24T05:59:43Z", "eventSource": "ec2.amazonaws.com", "eventName": "DescribeInstances", "awsRegion": "us-east-1", "sourceIPAddress": "REDACTED", "userAgent": "aws-cli/2.27.53 md/awscrt#0.26.1 ua/2.1 os/linux#6.6.87.2-microsoft-standard-WSL2 md/arch#x86_64 lang/python#3.13.4 md/pyimpl#CPython m/Z,b,C,E cfg/retry-mode#standard md/installer#exe md/distrib#ubuntu.22 sid/REDACTED md/prompt#off md/command#ec2.describe-instances", "requestParameters": { "instancesSet": {}, "filterSet": {} }, "responseElements": null, "requestID": "REDACTED", "eventID": "REDACTED", "readOnly": true, "eventType": "AwsApiCall", "managementEvent": true, "recipientAccountId": "REDACTED", "eventCategory": "Management", "tlsDetails": { "tlsVersion": "TLSv1.3", "cipherSuite": "TLS_AES_128_GCM_SHA256", "clientProvidedHostHeader": "ec2.us-east-1.amazonaws.com" } }

Beginne mit dem bereitgestellten CloudTrail-Ereignis und der Anforderung, Datenverkehr von Amazon Q CLI oder VS Code im Feld userAgent zu identifizieren. Ermittle, wie die CLI und die Erweiterung AWS API-Aufrufe durchführen und ob Versionsmetadaten hinzugefügt werden können; abgeschlossen bedeutet eine dokumentierte Audit-Methode oder einen klar abgegrenzten Implementierungsplan.