A security team wants to use AWS CloudTrail to monitor all actions and API calls in multiple accounts that are in the same organization in AWS Organizations. The security team needs to ensure that…

Question

Options

• AApply an SCP to all OUs to deny the cloudtrail:StopLogging action and the cloudtrail:DeleteTrail
• BCreate IAM policies in each account to deny the cloudtrail:StopLogging action and the
• CSet up Amazon CloudWatch alarms to notify the security team when a user disables CloudTrail in
• DUse AWS Config to automatically re-enable CloudTrail if a user disables CloudTrail in an account.

• A
  77% (20)
• B
  8% (2)
• C
  12% (3)
• D
  4% (1)

Explanation

SCPs in AWS Organizations allow you to enforce governance rules across multiple AWS accounts in your organization. By applying an SCP that denies the cloudtrail:StopLogging and cloudtrail:DeleteTrail actions, you ensure that no users or roles in the accounts can disable or delete CloudTrail, regardless of the permissions in individual accounts. SCPs override account- level permissions, making them the most effective way to enforce this restriction across multiple SCPs apply across all accounts in an organizational unit (OU), ensuring that the CloudTrail service is protected in every account. This prevents users from disabling or deleting CloudTrail at the account level, which is critical for maintaining continuous logging and auditability across all accounts in the organization. By using SCPs to deny the relevant CloudTrail actions, you ensure that CloudTrail cannot be disabled across any of the accounts in the organization, providing the most operationally efficient and secure solution.

No community discussion yet for this question.