A library consortium must prevent member libraries' accounts from disabling CloudTrail or creating unrestricted IAM admin users, while still detecting risky configurations. Which design best combines preventive and detective controls?
Select an answer to reveal the explanation.
Short Explanation
SCPs are the deadbolts on every branch library door; Config and GuardDuty are the security cameras. Lock out “turn off the trail” and “make a super-admin,” then keep detective services watching. Hope, shared root passwords, or deleting CloudTrail on purpose are how consortia get burned.
Full Explanation
AWS Organizations service control policies (SCPs) provide preventive guardrails that even account administrators cannot override within the organization. Denying actions that stop CloudTrail or create unrestricted IAM administrators blocks common privilege-escalation and anti-forensics paths. Detective controls such as AWS Config and Amazon GuardDuty still monitor residual risk and misconfigurations that SCPs alone cannot express. Removing CloudTrail, sharing root credentials, or relying on billing reviews fails both preventive and detective objectives for a multi-account library consortium.