Question

A financial services company uses AWS Control Tower to manage a multi-account landing zone across 40 accounts. During a routine audit, the security team discovers that an administrator in a workload account manually modified a CloudTrail trail that Control Tower had configured, disabling log file validation. The security team wants a supported, automated way to detect that the account has diverged from the Control Tower baseline and to bring it back into compliance. Which approach should they use?

Accepted Answer

Detect the change as drift in the Control Tower console or via the landing zone status, then re-register the OU or use the account update/repair action to re-apply the baseline configuration.

Answer

Create a custom AWS Config rule in every account that recreates the CloudTrail trail whenever validation is disabled, bypassing Control Tower entirely.

Answer

Attach an SCP to the workload OU that denies cloudtrail:UpdateTrail, which will automatically restore the deleted validation setting.

Answer

Delete and recreate the entire Control Tower landing zone so that all governed accounts receive a fresh baseline configuration.