SCS-C02 Question 466
Single answerYour company uses multiple AWS accounts within an AWS Organization. The Security team wants to monitor and ensure that all AWS accounts are logging API activity using AWS CloudTrail. Additionally, they must ensure that no one can accidentally delete or modify the CloudTrail configuration in individual accounts. Which solution provides the required visibility and control?
- A
Enable AWS CloudTrail in each account and store the logs in an S3 bucket in the respective account.
- B
Use an AWS Organizations delegated administrator account to enable an Organization Trail and apply an SCP to prevent changes to CloudTrail settings.
- C
Enable AWS CloudTrail in each account and use IAM policies to restrict access to the CloudTrail configuration.
- D
Use AWS Config to monitor CloudTrail activity and send alerts for any changes to the CloudTrail configuration.
Show answer and explanation
Correct answer: B
Explanation
The correct answer is to use an Organization Trail and an SCP. An Organization Trail ensures centralized logging for all accounts within the AWS Organization, providing visibility across your AWS infrastructure. An SCP applied at the organizational level can enforce restrictions on modifying or deleting the CloudTrail configuration, ensuring control over the logging setup. This approach aligns with best practices for managing security and compliance in multi-account AWS environments.
- A. Incorrect.
This option requires enabling CloudTrail in each account separately, but it does not centralize logging or prevent accidental deletion or modification of the CloudTrail configuration.
- B. Correct.
Using an Organization Trail centralizes logging across all accounts in the AWS Organization and ensures visibility. Applying a Service Control Policy (SCP) allows administrators to enforce restrictions on modifying or deleting the CloudTrail configuration, meeting both visibility and control requirements.
- C. Incorrect.
While enabling CloudTrail in each account and using IAM policies for access control can offer some level of security, it does not provide centralized visibility or enforce organization-wide controls.
- D. Incorrect.
AWS Config can monitor CloudTrail configuration changes, but it does not prevent the changes from occurring or enforce centralized logging. It is better suited for monitoring compliance rather than directly enforcing controls.