Centralizing CloudTrail Logs Across Accounts with Organization Trail

• A.Configure each account's CloudTrail to send logs to a central CloudWatch Logs group
• B.Create a CloudTrail trail in each account and deliver logs to the same S3 bucket
• ✓ C.Create an organization trail in the management account that is enabled for all accounts
• D.Use S3 replication to copy logs from individual account buckets to a central bucket

Why C: Option C is correct because AWS Organizations supports creating an organization trail in the management account that automatically applies to all accounts in the organization. This centralizes CloudTrail logs from every account into a single S3 bucket without requiring per-account configuration, ensuring consistent logging and simplifying management.

• A.The SCPs applied to member accounts are blocking CloudTrail from sending logs.
• B.CloudTrail is a regional service and the trail is only in one region.
• C.Member accounts have IAM policies that deny CloudTrail logging.
• ✓ D.The trail was not created as an organization trail.

Why D: Option D is correct because when a CloudTrail trail is created in the management account without enabling the 'organization trail' option, it only logs events for the management account itself and not for member accounts. To centralize logging across all accounts in AWS Organizations, the trail must be explicitly created as an organization trail, which automatically applies to all current and future member accounts. Without this setting, member account events are not forwarded to the management account's trail.

• A.Add an IAM role in the security account and allow the CloudTrail service in each member account to assume that role.
• B.Configure the bucket ACL to allow write access for all member account root users.
• C.Add a bucket policy that grants the service principal 'logs.amazonaws.com' s3:PutObject permissions.
• ✓ D.Add a bucket policy that grants the CloudTrail service principal s3:PutObject permissions for the bucket, with a condition that the source account is in the organization.

Why D: Option D is correct because CloudTrail cross-account logging requires a bucket policy that grants the CloudTrail service principal (cloudtrail.amazonaws.com) s3:PutObject permission, with a condition (aws:SourceOrgID or aws:SourceAccount) to restrict access to only the member accounts within the AWS Organization. This ensures centralized delivery while preventing unauthorized accounts from writing to the bucket.

• ✓ A.Configure the central S3 bucket policy to allow CloudTrail from all accounts in the organization to write logs.
• B.Use a VPC endpoint and route logs through a central VPC.
• C.Attach an SCP to allow CloudTrail to write to the central bucket.
• D.Create an IAM role in each member account and allow the central account to assume it.

Why A: Option A is correct because CloudTrail can deliver logs from all accounts in an AWS Organization to a single central S3 bucket by configuring the bucket policy to grant the CloudTrail service principal (cloudtrail.amazonaws.com) from each member account the s3:PutObject permission. This approach leverages the organization's trusted access, eliminating the need for individual IAM roles or cross-account assumptions, as CloudTrail automatically uses the organization's management account to validate member account identities.

• A.Use AWS Config to forward logs to a central S3 bucket.
• B.Enable CloudTrail in each account and use AWS Organizations to aggregate logs.
• C.Create a CloudTrail trail in the audit account that logs all accounts via CloudWatch Logs.
• ✓ D.Create a CloudTrail trail in the audit account with an S3 bucket, and add a bucket policy that grants cross-account permissions for each member account to deliver logs. Then configure each member account to use the same trail.

Why D: Option D is correct because it uses a single CloudTrail trail in the audit account with a central S3 bucket, and the bucket policy grants the necessary s3:PutObject permissions to each member account's CloudTrail service principal. Each member account then configures CloudTrail to use the same trail (the audit account's trail), which allows CloudTrail to deliver logs from all accounts to the central bucket without requiring separate trails or manual log forwarding.