Question

A security team manages a 200-account AWS Organization. They centrally enable GuardDuty, AWS Config, and CloudTrail in every account through delegated administration. Recently, an application team's IAM administrator in a member account stopped their local CloudTrail trail and disabled AWS Config recorders to reduce noise, creating a compliance gap. The security team wants to guarantee that no principal in any member account — including account administrators — can disable or delete these foundational security services, while still allowing normal application development. What is the MOST effective way to enforce this organization-wide?

Accepted Answer

Attach a service control policy (SCP) to the organizational units that explicitly denies actions such as cloudtrail:StopLogging, cloudtrail:DeleteTrail, config:StopConfigurationRecorder, and config:DeleteConfigurationRecorder.

Answer

Create an AWS Config managed rule with automatic remediation that re-enables CloudTrail and Config recorders whenever they are stopped.

Answer

Apply an IAM permissions boundary to every IAM administrator role in the member accounts that removes the ability to modify CloudTrail and Config.

Answer

Enable AWS Control Tower and rely on its detective guardrails to alert the security team when CloudTrail or Config is disabled.