All CloudTrail management events from every municipal AWS account m…

Question

All CloudTrail management events from every municipal AWS account must be delivered to an immutable logging-account bucket that member accounts cannot alter. Which auditing strategy best meets this requirement?

Accepted Answer

Configure an organization CloudTrail (or equivalent multi-account trail) that delivers logs to a dedicated logging account S3 bucket with restrictive bucket policies, retention controls, and immutability safeguards such as Object Lock where required. — Central logging is the black box in a locked hangar—every plane writes there, nobody in the fleet can erase the tape. Organization CloudTrail into a hardened logging-account bucket is that hangar. Per-account editable buckets invite silent gaps.

Answer

Allow each account to keep trails only in its own writable bucket with no central copy.

Answer

Disable CloudTrail in member accounts to save cost after the first month of operations.

Answer

Store trail digests in email inboxes instead of durable object storage.

All CloudTrail management events from every municipal AWS account must be delivered to an immutable logging-account bucket that member accounts cannot alter. Which auditing strategy best meets this requirement?

Short Explanation

Full Explanation