Question

A security governance team manages an AWS Organization with 200 accounts across multiple OUs. They centrally deploy GuardDuty, Config, and CloudTrail using delegated administrator accounts. Recently, a developer with local administrator privileges in a workload account disabled GuardDuty and stopped the account's CloudTrail trail to reduce noise. The team wants to prevent ANY member account principal — including account administrators — from disabling these security services, while still allowing the delegated security administrator account to manage them centrally. Which approach best enforces this at scale?

Accepted Answer

Attach an SCP to the organization root (or relevant OUs) that denies the disable/stop/delete API actions for GuardDuty, Config, and CloudTrail, using a condition or NotPrincipal-style exception so the actions are only permitted from the delegated security administrator role.

Answer

Create an IAM permission boundary in every member account that removes the ability to call GuardDuty and CloudTrail disable actions, and attach it to all IAM roles.

Answer

Enable AWS Config rules that detect when GuardDuty or CloudTrail is disabled and use an automatic remediation action to re-enable them within minutes.

Answer

Turn on Security Hub central configuration and rely on the AWS Foundational Security Best Practices standard to block configuration changes to security services in member accounts.