Log groups

Log group	Fields of interest
/aws/lambda/rag-sample-<env>-api	cold_start, xray_trace_id, RDS Data API client errors
/aws/lambda/rag-sample-<env>-authorizer	cold_start, RDS Data API error on token lookup
/aws/lambda/rag-sample-<env>-ingestion	RDS Data API and Bedrock call durations
API Gateway access logs (if enabled)	sourceIp, requestId, status, responseLatency

CloudWatch Logs Insights query to surface RDS Data API errors in the API Lambda log group:

fields @timestamp, @message
| filter @message like /rds-data|RDS Data API|ExecuteStatement/
| sort @timestamp desc
| limit 50

VPC Flow Logs are not enabled. No ENIs emit traffic inside the VPC today; see RAG010. If troubleshooting intra-VPC connectivity becomes necessary after a future architecture change, enable VPC Flow Logs on the VPC and publish to CloudWatch Logs or S3 before diagnosing.