Question

A security engineer receives a GuardDuty finding of type Stealth:IAMUser/CloudTrailLoggingDisabled indicating an attacker used compromised credentials to stop logging on the organization's primary CloudTrail trail. The engineer must restore audit visibility as quickly as possible and ensure logging cannot be trivially disabled again by the same technique. Which combination of actions BEST addresses both the immediate recovery and future prevention?

Accepted Answer

Re-enable the CloudTrail trail (StartLogging), then apply an SCP that denies cloudtrail:StopLogging and cloudtrail:DeleteTrail to all principals except a break-glass role, and enable an organization trail so member accounts cannot disable it locally.

Answer

Delete the affected trail and create a new one in a different Region, relying on GuardDuty to continue monitoring without CloudTrail.

Answer

Enable CloudTrail log file integrity validation and rotate the compromised access keys, which will automatically restart logging on the stopped trail.

Answer

Turn on VPC Flow Logs and Amazon S3 server access logging as replacement data sources, since these cover the same events that CloudTrail records.