Bounded post-run enrichment from one caller-selected CloudWatch Logs group.

Supply the destination configured for your telemetry, a UTC interval, explicit credentials, and logs:FilterLogEvents permission for that group. Only FilterLogEvents is called, with unmask: false; no logging configuration or IAM changes occur. CloudWatch requires the optional :ex_aws_auth dependency, without EventStream.

Retained payloads preserve each outer log record and its exact message string. The recognized message dialect is standard OTLP JSON resourceSpans / scopeSpans / spans, with hex trace/span IDs, unsigned nanosecond timestamps, and a string session.id attribute on the span or resource. This is a supported standard input shape, not verified live AgentCore harness output. Matching spans establish only same-session association. Unsupported messages and native identity mismatches remain private raw evidence and make coverage partial.

A drained cursor covers retrieval for the declared interval at collection time; delayed telemetry and provider-internal activity may still be absent. Budgets include prior evidence, inspected records, pages and retained bytes; they do not bound the HTTP adapter's response buffer. The deadline cancels an active request. If coverage metadata cannot fit alongside bounded prior evidence, returns a :bound_exceeded error instead of evicting that evidence.