Question

A financial services company manages 120 accounts through AWS Control Tower with all accounts in a well-structured OU hierarchy. The security team wants to guarantee that no member account can ever disable AWS CloudTrail logging, and they need this protection to be impossible to bypass — even by a user who has full administrative IAM permissions in a member account. Which approach meets this requirement with the least ongoing operational effort?

Accepted Answer

Ensure the Control Tower mandatory preventive guardrail that denies CloudTrail configuration changes is applied, which Control Tower implements as a service control policy on the OUs.

Answer

Enable a detective guardrail in Control Tower backed by an AWS Config rule that flags any account where CloudTrail is disabled, then configure an EventBridge rule to re-enable it automatically.

Answer

Deploy an AWS Config conformance pack across the organization that includes the cloudtrail-enabled managed rule with an SSM automatic remediation action.

Answer

Create a permission boundary attached to all IAM roles in member accounts that denies the cloudtrail:StopLogging and cloudtrail:DeleteTrail actions.