Question

A financial services company is designing a multi-account landing zone using AWS Control Tower. Compliance requires that all CloudTrail and AWS Config logs from every member account be stored in a dedicated, tamper-resistant location that individual account administrators cannot modify or delete. The security team, operating from a separate account, must retain read access for investigations. Which approach best meets these requirements?

Accepted Answer

Aggregate logs into a centralized Log Archive account created by Control Tower, apply an S3 bucket policy and Object Lock, and grant the Security account cross-account read access.

Answer

Enable CloudTrail in each member account writing to a local S3 bucket, and use an SCP to deny s3:DeleteObject on those buckets.

Answer

Store all logs in the management account's S3 bucket and rely on the default management account isolation to prevent tampering.

Answer

Have each account replicate its CloudTrail logs to the Security account using S3 Cross-Region Replication with a deny-delete lifecycle rule.