Question

A company uses AWS Organizations with all features enabled. The security team requires that no IAM principal in any member account—including account root users and local administrators—can stop, delete, or disable the organization CloudTrail trail or its logging. Individual account teams still need full administrative access for all other services. Which approach enforces this requirement most effectively?

Accepted Answer

Attach a Service Control Policy (SCP) to the organization root that denies cloudtrail:StopLogging, cloudtrail:DeleteTrail, and cloudtrail:UpdateTrail actions on the organization trail.

Answer

Attach an IAM permissions boundary to every user and role in each member account that removes CloudTrail write permissions.

Answer

Create an IAM identity-based policy in each member account with an explicit deny on CloudTrail modification actions and attach it to all administrators.

Answer

Enable AWS Config with a managed rule that detects when CloudTrail logging is disabled and triggers automatic remediation.