Why Doesn't CloudTrail Organization Trail Include Newly Added Accounts?
A company runs a multi-account AWS environment using AWS Organizations. The security team needs to implement centralized logging for all AWS CloudTrail events across all accounts. They create a new trail in the management account with the following configuration: trail name 'central-trail', apply to all accounts in the organization, enable data events for all S3 buckets, and store logs in a centralized S3 bucket. After one week, they notice that some accounts are not delivering CloudTrail logs to the central bucket. The security engineer verifies that the trail is still configured to apply to all accounts and that the S3 bucket policy allows cross-account access. What is the MOST likely reason for the missing logs?
Quick Answer
The key concept here is that an organization trail's apply-to-all-accounts setting is evaluated at the moment it is configured, not continuously re-evaluated as the organization's membership changes. When the trail was created with the apply-to-all-accounts option, it correctly picked up every account that was a member of the organization at that time, but AWS Organizations trails do not automatically detect and enroll accounts added afterward; the trail configuration has to be explicitly updated, or the organization trail feature re-applied, before logs from newly joined accounts start flowing to the central bucket. This matters because everything else in the scenario checks out: the trail is still confirmed to apply to all accounts, and the bucket policy correctly allows cross-account delivery, which rules out a permissions problem and points instead toward a membership-timing issue. The pattern to remember is that many organization-wide features, whether trails, Config aggregators, or SCPs attached to an OU, apply to the membership of the organization as it exists when the feature is configured, and new accounts are not always automatically swept in without an explicit step. Any time a multi-account scenario says a feature was working, new accounts were added later, and then some but not all accounts stopped reporting data, treat account timing relative to configuration as the first thing to check before assuming a policy or permissions failure.
⚠ Common exam trap
Many exam-takers assume 'apply to all accounts' means the trail dynamically includes any account added later, but in reality, the trail only applies to accounts that were members at the time of creation and must be manually updated for new accounts.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Some accounts were added to the organization after the trail was created, and the trail was not updated to include them
When a trail is created in the management account with 'apply to all accounts in the organization', it automatically includes all current member accounts. However, if new accounts are added to the AWS Organization after the trail is created, the trail does not automatically extend to those new accounts. The trail must be updated (e.g., via the CloudTrail console or API) to include the newly added accounts, or the organization trail feature must be re-enabled. This is why logs from accounts added after trail creation are missing.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
The member accounts have not enabled CloudTrail Insights
Why it's wrong here
CloudTrail Insights is optional and not required for logging.
- ✗
The S3 bucket policy does not grant the correct permissions to the member accounts
Why it's wrong here
The engineer verified the policy is correct.
- ✗
The trail is not configured as a multi-region trail
Why it's wrong here
Organization trails are multi-region by default.
- ✓
Some accounts were added to the organization after the trail was created, and the trail was not updated to include them
Why this is correct
When new accounts join, the trail must be updated or they need to enable the trail manually.
Quick reference
AWS S3 Storage Class Comparison
| Storage Class | Min Duration | Retrieval | Use Case |
|---|---|---|---|
| S3 Standard | None | Immediate | Frequently accessed data |
| S3 Standard-IA | 30 days | Immediate | Infrequent access, rapid retrieval |
| S3 One Zone-IA | 30 days | Immediate | Non-critical infrequent data |
| S3 Intelligent-Tiering | None | Immediate–hours | Unknown or changing access patterns |
| S3 Glacier Instant | 90 days | Milliseconds | Archive with instant retrieval |
| S3 Glacier Flexible | 90 days | Minutes–hours | Archive, flexible retrieval |
| S3 Glacier Deep Archive | 180 days | Hours | Long-term compliance archive |
Go deeper
Related to this question
About these practice questions
Courseiva writes every SCS-C02 question from scratch — 376 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
Same concept, more angles
1 more way this is tested on SCS-C02
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. A company has a multi-account AWS environment using AWS Organizations. The security team wants to centralize all CloudTrail logs from all accounts into a single S3 bucket in the management account. They have enabled CloudTrail in the management account with an organization trail that delivers logs to an S3 bucket. However, logs from member accounts are not appearing. The S3 bucket policy includes permissions for CloudTrail to write logs, but it does not explicitly grant access to member accounts. What should the team do to ensure that member account CloudTrail logs are delivered to the central S3 bucket?
hard- A.Ask each member account to create a new trail that delivers logs to the same S3 bucket.
- B.Disable the organization trail and recreate it, ensuring that all member accounts are selected.
- ✓ C.Verify that the organization trail is configured correctly with the 'Include all accounts in my organization' option enabled, and that the S3 bucket policy allows CloudTrail to write from all accounts.
- D.Modify the S3 bucket policy to grant write access to the CloudTrail service principal for each member account's AWS account ID.
Why C: An organization trail automatically delivers logs from all accounts without needing separate trails in each account. If logs are not appearing, the issue is likely that the organization trail is not properly configured or member accounts are not enabled. Option A is incorrect because member trails cannot write to a bucket in another account without proper cross-account permissions, and this approach is not recommended. Option B is incorrect because disabling and re-enabling might not fix the underlying issue. Option D is incorrect because the bucket policy must allow CloudTrail from all accounts, but the primary cause is often the organization trail setup.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SCS-C02 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SCS-C02 exam.