How can I audit what AWS api calls are being made by Amazon Q Developer CLI?

Hi Team,

Given These two lovely articles
https://www.404media.co/hacker-plants-computer-wiping-commands-in-amazons-ai-coding-agent/
https://www.lastweekinaws.com/blog/amazon-q-now-with-helpful-ai-powered-self-destruct-capabilities/
figured i'd ask, how can we audit what calls Amazon Q is making to the AWS API?

is it possible to add something to the "userAgent" segment that displays the amazonq cli / vscode extension and the version that its using?

For example (I know this is vscode - but I use Q CLI as well)

shows no trace of "amazon-q" anywhere in my cloudtrail event ( redacted all my info)
`{
"eventVersion": "1.10",
"userIdentity": {
"type": "AssumedRole",
"principalId": "REDACTED",
"arn": "arn:aws:sts::REDACTED:assumed-role/AWSReservedSSO_AWSAdministratorAccess_REDACTED/REDACTED",
"accountId": "REDACTED",
"accessKeyId": "REDACTED",
"sessionContext": {
"sessionIssuer": {
"type": "Role",
"principalId": "REDACTED",
"arn": "arn:aws:iam::REDACTED:role/aws-reserved/sso.amazonaws.com/ap-southeast-2/AWSReservedSSO_AWSAdministratorAccess_REDACTED",
"accountId": "REDACTED",
"userName": "AWSReservedSSO_AWSAdministratorAccess_REDACTED"
},
"attributes": {
"creationDate": "2025-07-24T05:59:42Z",
"mfaAuthenticated": "false"
}
}
},
"eventTime": "2025-07-24T05:59:43Z",
"eventSource": "ec2.amazonaws.com",
"eventName": "DescribeInstances",
"awsRegion": "us-east-1",
"sourceIPAddress": "REDACTED",
"userAgent": "aws-cli/2.27.53 md/awscrt#0.26.1 ua/2.1 os/linux#6.6.87.2-microsoft-standard-WSL2 md/arch#x86_64 lang/python#3.13.4 md/pyimpl#CPython m/Z,b,C,E cfg/retry-mode#standard md/installer#exe md/distrib#ubuntu.22 sid/REDACTED md/prompt#off md/command#ec2.describe-instances",
"requestParameters": {
"instancesSet": {},
"filterSet": {}
},
"responseElements": null,
"requestID": "REDACTED",
"eventID": "REDACTED",
"readOnly": true,
"eventType": "AwsApiCall",
"managementEvent": true,
"recipientAccountId": "REDACTED",
"eventCategory": "Management",
"tlsDetails": {
"tlsVersion": "TLSv1.3",
"cipherSuite": "TLS_AES_128_GCM_SHA256",
"clientProvidedHostHeader": "ec2.us-east-1.amazonaws.com"
}
}
`

Inizia con l’evento CloudTrail fornito e la richiesta di identificare il traffico di Amazon Q CLI o VS Code nel campo userAgent. Determina in che modo la CLI e l’estensione effettuano chiamate a AWS API e se è possibile aggiungere metadati sulla versione; il lavoro è completo quando è disponibile un metodo di audit documentato o un piano di implementazione chiaramente definito.

Scritto dal modello di indicizzazione a partire dal testo della issue.