Question

A company has 40 accounts in AWS Organizations. The security team wants to guarantee that management events from every existing and future member account are captured in a single, tamper-evident location, without requiring administrators in each account to create or maintain their own trails. Which approach BEST meets these requirements with the least ongoing operational overhead?

Accepted Answer

Create an organization trail from the management account that delivers logs to a centralized S3 bucket, and enable log file validation.

Answer

Provide a CloudFormation StackSet that deploys an individual account-level trail in each member account, delivering to a local S3 bucket.

Answer

Enable CloudTrail Insights in each member account and forward findings to a central Security Hub aggregator.

Answer

Configure AWS Config in all accounts and use an aggregator to record management API activity in the management account.