Question

A financial services company uses AWS Control Tower to govern 40 member accounts across multiple OUs. The security team has a compliance requirement: developers must never be able to disable AWS CloudTrail logging in any account, and any account that has an S3 bucket without server-side encryption must be flagged for review (but not blocked). The team wants to implement both requirements using Control Tower guardrails with the least operational overhead. Which combination of guardrails should they apply?

Accepted Answer

Apply a preventive guardrail (SCP-based) to stop CloudTrail from being disabled, and a detective guardrail (AWS Config rule-based) to identify S3 buckets without encryption.

Answer

Apply a detective guardrail for both requirements, relying on AWS Config rules to detect and automatically remediate any violations.

Answer

Apply a preventive guardrail for both requirements, using SCPs to block CloudTrail disabling and to reject unencrypted S3 bucket creation.

Answer

Apply a proactive guardrail using CloudFormation hooks for CloudTrail and a detective guardrail for S3 encryption reporting.