A company has multiple AWS accounts in an organization in AWS Organizations that has all features enabled. The company's DevOps administrator needs to improve security across all the company's AWS acc

Question

Options

• ACreate a new organization trail in AWS CloudTrail. Configure the trail to send log events to
• BCreate an unused access analysis for the organization by using AWS Identity and Access
• CCreate a new organization trail in AWS CloudTrail. Create a table in Amazon Athena that uses
• DGenerate a Service access report for each account by using Organizations. From the results, pull

• A
  81% (17)
• B
  5% (1)
• C
  10% (2)
• D
  5% (1)

Explanation

By creating an organization trail in AWS CloudTrail, you ensure that all API activity across all AWS accounts in the organization is captured. This gives you a complete and centralized view of user and role activity across the entire organization. CloudWatch Contributor Insights is designed for analyzing high-cardinality data, such as tracking the top users and roles by activity. By using a Contributor Insights rule that focuses on the userIdentity.arn log field from CloudTrail, you can quickly identify the most active users and roles across all accounts. This provides real-time insights with minimal operational overhead. This solution leverages CloudTrail for logging and CloudWatch for analysis, both of which are AWS-native services. The setup is automated, and once configured, it continuously provides insights without requiring manual querying or data extraction. By using CloudWatch Contributor Insights with a CloudTrail organization trail, this solution provides a highly efficient, scalable, and real-time method to track the top users and roles across all AWS accounts.

No community discussion yet for this question.