A county IT board wants separate AWS accounts for parks, finance, and shared services, plus a guardrail so no account can disable CloudTrail. Which design best meets that requirement?
Select an answer to reveal the explanation.
Short Explanation
Think of the county like three locked offices under one city hall roof, with a rule nobody can yank the security cameras. Organizations plus SCPs (and Control Tower when you want the landing-zone kit) put that rule above every account so CloudTrail stays on. One flat account with a pinky swear is not a guardrail.
Full Explanation
AWS Organizations lets you isolate parks, finance, and shared services into separate accounts while applying preventive Service Control Policies that deny actions such as disabling CloudTrail—even for account administrators. AWS Control Tower can accelerate a multi-account baseline with recommended guardrails. A single shared account with IAM users, local-only logging without org policy, or long-lived keys with verbal promises does not enforce the required multi-account security strategy.