All CloudTrail management events from every municipal AWS account must be delivered to an immutable logging-account bucket that member accounts cannot alter. Which auditing strategy best meets this requirement?

Immutable, organization-wide auditing of CloudTrail management events requires an organization trail (or equivalent multi-account trail) that delivers logs to a dedicated logging-account S3 bucket. Restrictive bucket policies allow only the CloudTrail service to write, member accounts cannot alter or delete the central objects freely, and immutability safeguards such as Object Lock, retention policies, and MFA delete (where appropriate) protect evidentiary integrity. That design gives auditors one trustworthy stream of management activity across every municipal account.

Allowing each account to keep trails only in its own writable bucket with no central copy lets local admins tamper with or delete evidence of their own actions. Disabling CloudTrail in member accounts after the first month removes ongoing audit coverage to save cost—an unacceptable trade for public-sector accountability. Storing trail digests in email inboxes instead of durable object storage fails retention, integrity, and search requirements.

Exam caveat: organization trails still benefit from a dedicated log-archive account and bucket policy that denies unapproved deletes; digests validate integrity but are not a substitute for the log objects themselves. Operational check: confirm the org trail is present in member accounts, drop a management API call, see the event land in the logging bucket, attempt a delete from a member role and expect denial, and validate Object Lock/retention settings with the compliance team.