Question

A financial services company uses AWS Organizations with 40 member accounts. The security team must ensure that a tamper-resistant, centralized audit trail of all API activity across every account is retained for 7 years, and that member account administrators cannot disable or delete the logging configuration. Which approach best meets these requirements?

Accepted Answer

Enable an organization trail from the management account, deliver logs to a central S3 bucket with Object Lock in compliance mode, and use an SCP to deny cloudtrail:StopLogging and cloudtrail:DeleteTrail in member accounts

Answer

Instruct each member account administrator to enable a local CloudTrail trail and periodically export the logs to a shared S3 bucket in the security account

Answer

Enable an organization trail and rely on IAM policies in each member account to prevent administrators from modifying the trail configuration

Answer

Enable AWS Config across all accounts and use Config snapshots stored in S3 as the 7-year audit record of API activity