Question

A financial services company uses AWS Organizations with all features enabled. The security team centrally manages Amazon GuardDuty and AWS CloudTrail from a delegated administrator account. Recently, an engineer with local administrator privileges in a member account disabled the GuardDuty detector and stopped a CloudTrail trail in their account, creating a compliance gap. The security team wants a preventive control that stops any principal in member accounts—including local administrators—from disabling these security services, while still allowing the delegated administrator to manage them. What should the solutions architect implement?

Accepted Answer

Attach a Service Control Policy to the relevant organizational units that denies GuardDuty and CloudTrail deletion/stop/disable actions, using a condition that excludes the delegated administrator and organization management roles.

Answer

Enable AWS Config rules in every member account to detect when GuardDuty or CloudTrail is disabled and trigger an SSM Automation runbook to re-enable them.

Answer

Create an IAM permissions boundary in each member account that removes the ability to modify GuardDuty and CloudTrail from all local IAM users and roles.

Answer

Configure an Amazon EventBridge rule in the delegated administrator account that reacts to disable events and invokes a Lambda function to re-enable the services.