Examkin

Question

Difficulty: MediumMulti-Account Governance and Organizational Structure

An enterprise is establishing a centralized logging architecture across its multi-account environment managed by AWS Organizations. The security team requires that all API activity across all current and future member accounts be logged to a central, read-only Amazon S3 bucket, and that member accounts be prevented from disabling or altering these logging configurations. Arrange the steps in the correct sequence to implement this centralized logging solution in accordance with AWS best practices.

  1. 1Create a dedicated Log Archive account under the Security Organizational Unit (OU).
  2. 2Create a centralized Amazon S3 bucket in the Log Archive account, and configure a bucket policy that allows the AWS CloudTrail service principal to write logs.
  3. 3Enable trusted access for CloudTrail in AWS Organizations, and create an organization trail in the management account that targets the centralized S3 bucket.
  4. 4Attach a Service Control Policy (SCP) to the organization root or OUs to prevent member accounts from modifying or deleting CloudTrail resources.

Answer

The correct sequence begins with creating the Log Archive account, followed by creating the central S3 bucket with the appropriate bucket policy, then creating the organization-level CloudTrail trail, and finally applying a Service Control Policy to prevent member accounts from tampering with the CloudTrail configuration.
The correct sequence ensures that resource dependencies are satisfied chronologically. The Log Archive account must exist first to host the destination S3 bucket. The S3 bucket must then be created with a policy that allows the CloudTrail service principal to write logs from the organization; without this policy, creating the organization trail will fail. After the bucket is ready, the organization trail is created to deliver logs from all accounts. Finally, an SCP is applied to prevent member accounts from altering the trail, securing the auditing setup.

Step-by-Step Solution

1
Provision the Log Archive account.
A dedicated, isolated account exists under the Security OU for storing audit logs.
The destination account must be created first to own the central S3 logging bucket.
2
Create the S3 bucket and attach a CloudTrail-compliant bucket policy.
An S3 bucket is configured in the Log Archive account, granting write permissions to the CloudTrail service principal.
AWS CloudTrail validates the bucket's existence and permissions when the organization trail is created. If the bucket or correct policy is missing, trail creation will fail.
3
Create the organization trail in the management account.
A multi-region organization trail is deployed to all current and future member accounts.
This establishes centralized logging for all API activity across the entire organization.
4
Deploy a Service Control Policy restricting CloudTrail modifications.
Member accounts are blocked from disabling CloudTrail, deleting the trail, or changing S3 settings.
This enforces governance and prevents local administrators from tampering with the audit logs.

Key Concept

Centralized multi-account logging and guardrails using AWS Organizations and CloudTrail
Estimated Time:2m 0s
Rate this question

Topics

Multi-Account Governance and Organizational Structure

More questions from this topic