All accounts in an AWS Organization must record API activity.
Account administrators must not be able to stop or delete the audit trail.
Which audit-log approach is most appropriate?
Use an organization trail that delivers to a protected central S3 log account with Object Lock and KMS.
Detailed explanation
Required evidence and retention would be lost.
Required evidence and retention would be lost.
Coverage gaps and inconsistent destinations are more likely.
Coverage gaps and inconsistent destinations are more likely.
Search and alerting are useful, but long-term immutable retention still needs design.
Search and alerting are useful, but long-term immutable retention still needs design.
The organization-wide scope is centrally configured and the log account can be separated from workload administrators.
The organization-wide scope is centrally configured and the log account can be separated from workload administrators.
Check official documentation
Compare the following points with the official documentation.
AWS CloudTrail organization trails、centralized logging、S3 Object Lockの公式説明を確認する。
What to confirm
個別Trailの手動運用と組織Trailによる中央監査の違いを説明できる。
Key points
- Organization trail
- Central logging
- Object Lock
- Audit
Notes
- Environment: AWS公式DEA-C01試験ガイドと各サービスの公式ドキュメントの確認
- Confirm current AWS service behavior in the official DEA-C01 documentation.
Foundation review
Account separation
Separate event producers from the account that controls retention and deletion.
Scope selection
Choose management events, data events, and Insights according to need and cost.