Audit API activity in several accounts under AWS Organizations.
Aggregate logs in a location that workload-account administrators cannot delete or alter.
Choose TWO appropriate components.
Use an organization trail for consistent collection and aggregate logs in a dedicated log account with restricted permissions.
Detailed explanation
Separating the log account limits who can alter the central audit store.
Separating the log account limits who can alter the central audit store.
An organization trail applies a consistent collection configuration across the organization.
An organization trail applies a consistent collection configuration across the organization.
This makes central auditing difficult and leaves logs exposed to member-account administration.
This makes central auditing difficult and leaves logs exposed to member-account administration.
Administrators could delete audit evidence, weakening tamper resistance.
Administrators could delete audit evidence, weakening tamper resistance.
Check official documentation
Compare the following points with the official documentation.
AWS CloudTrail organization trailとS3ログ集約の公式説明を確認する。
What to confirm
収集設定と改ざん耐性のあるログ保管を組み合わせられる。
Key points
- CloudTrail organization trail
- Log account
- S3 aggregation
Notes
- Environment: AWS公式CloudTrail・Organizationsドキュメントの確認
- Confirm current AWS service behavior in the official documentation.
Foundation review
Collection versus storage
The organization trail determines what is collected; the log account controls where it is protected.
Tamper resistance
Restricting deletion in the central account preserves audit evidence.