Question

A company uses AWS Organizations with 40 member accounts. The security team needs to capture all management event API activity across every existing and future account, delivering logs to a single S3 bucket in a dedicated logging account. Member account administrators must not be able to modify or delete the trail configuration in their own accounts. Which approach meets these requirements with the least ongoing administrative effort?

Accepted Answer

Create an organization trail from the Organizations management account that logs to the centralized S3 bucket in the logging account.

Answer

Instruct each member account administrator to create a trail that delivers logs to the centralized S3 bucket, and audit compliance monthly.

Answer

Create a CloudFormation StackSet that deploys an individual per-account trail to all member accounts and reruns weekly to catch new accounts.

Answer

Enable AWS Config in all accounts and use a conformance pack to forward configuration snapshots to the logging account bucket.