Question

A financial services company must prove to auditors that no member account in their AWS Organization can disable AWS Config recording or delete the organization CloudTrail trail without immediate detection and automatic re-enablement. Account administrators in member accounts currently hold broad IAM permissions that include config and cloudtrail actions. Which combination of controls BEST enforces this governance requirement with the least ongoing operational effort?

Accepted Answer

Deploy a Service Control Policy at the organization root denying cloudtrail:StopLogging, cloudtrail:DeleteTrail, and config:StopConfigurationRecorder/DeleteConfigurationRecorder, and enable AWS Config with an organization-managed aggregator plus a conformance pack to continuously verify recorder status.

Answer

Grant each member account administrator a permissions boundary that removes config and cloudtrail write actions, and rely on quarterly manual audits to confirm compliance.

Answer

Create an EventBridge rule in each member account that triggers a Lambda function to re-enable Config whenever StopConfigurationRecorder is called, and email the security team when CloudTrail is deleted.

Answer

Enable CloudTrail Insights and GuardDuty in every account so that anomalous API activity such as StopLogging generates findings that the security team can review and remediate.