Centralize API Call Logging Across Multi-Account AWS
A company is implementing a multi-account strategy using AWS Organizations. They need to centralize logging of all API calls across accounts. Which solution meets this requirement with the least operational overhead?
Quick Answer
The correct answer is to create an organization trail in the management account with CloudTrail. This solution works because AWS CloudTrail’s organization trail feature, when enabled from the management account, automatically logs API calls for all member accounts in the AWS Organization without requiring any per-account configuration, thus centralizing API call logging across multi-account environments with minimal operational overhead. On the AWS Certified Solutions Architect Professional SAP-C02 exam, this scenario tests your understanding of CloudTrail’s organization-level capabilities versus manual per-account setups, which are common traps that increase complexity. Remember, CloudTrail is the only service that captures management and data plane API calls across accounts, while CloudWatch Logs handles log streams and S3 access logs are limited to bucket operations. A useful memory tip: “One trail to rule them all” — a single organization trail in the management account logs every account’s API calls automatically.
⚠ Common exam trap
It's easy for candidates to think they need to configure CloudTrail in each account individually (Option B) or use CloudWatch Logs streaming (Option A), missing the organization trail feature that automatically centralizes logging with zero per-account effort.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Create an organization trail in the management account with CloudTrail.
AWS Organizations supports creating an organization trail in the management account that automatically logs API calls for all member accounts without requiring per-account configuration. This centralizes logging with minimal operational overhead, as CloudTrail handles the aggregation across the organization.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Enable CloudWatch Logs in each account and stream to a central log group.
Why it's wrong here
CloudWatch Logs does not capture all API calls; CloudTrail is needed.
- ✗
Create a CloudTrail trail in each account and aggregate logs to a central S3 bucket.
Why it's wrong here
Requires manual setup per account, increasing overhead.
- ✓
Create an organization trail in the management account with CloudTrail.
Why this is correct
Organization trail automatically logs all accounts, minimizing overhead.
- ✗
Enable S3 server access logs on all accounts and send to a central bucket.
Why it's wrong here
S3 access logs only record S3 operations, not all API calls.
Go deeper
Related to this question
About these practice questions
One of 1,660 original SAP-C02 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
Same concept, more angles
1 more way this is tested on SAP-C02
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. A company uses AWS Organizations with a management account and multiple member accounts. The management account has a trail in AWS CloudTrail that logs all management events for all accounts. The security team wants to also log data events for S3 buckets across all accounts. They create a new trail in the management account with data events enabled for all S3 buckets in all accounts. However, data events from member accounts are not appearing in the CloudTrail logs. What is the most likely cause?
easy- A.The S3 bucket in the management account does not have a bucket policy that allows CloudTrail to write logs from member accounts.
- B.The trail is not configured to log data events for all S3 buckets; it only logs for specific buckets.
- ✓ C.Data events for S3 buckets are not logged centrally by a trail created in the management account; each account must have its own trail for data events.
- D.The S3 bucket is encrypted with a KMS key that CloudTrail does not have permission to use.
Why C: A trail created in the management account of AWS Organizations can log management events for all member accounts, but data events (such as S3 object-level operations) are logged only for the account that owns the trail. To capture data events from member accounts, each member account must create its own trail and enable data event logging for its S3 buckets. Option A is incorrect because CloudTrail can write to an S3 bucket even without a bucket policy, as long as the bucket is in the same account. Option B is incorrect because the trail was configured to log data events for all S3 buckets, but that setting only applies to the management account, not member accounts. Option D is incorrect because KMS encryption does not affect the ability to log data events; CloudTrail can use the appropriate KMS permissions if configured.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SAP-C02 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SAP-C02 exam.