Prevent Disabling CloudTrail with SCP — AWS Organizations Security
A company uses AWS Organizations with multiple accounts. The security team wants to prevent all users in the production account from disabling AWS CloudTrail or modifying its configuration. What is the MOST effective way to achieve this?
Quick Answer
The reason a broad SCP denying multiple specific actions is the most effective approach is that CloudTrail can be tampered with in more than one way, and a control that blocks only one of those ways leaves the others open. Someone could stop logging with StopLogging, delete the trail with DeleteTrail, or weaken its configuration with UpdateTrail, so a preventive control needs to deny all of those actions, not just deletion, to guarantee CloudTrail keeps running as configured. An SCP is also structurally the right mechanism because it applies at the account level to every principal, including the root user, which is critical since CloudTrail tampering is exactly the kind of action a compromised or malicious privileged principal might attempt. This is what separates an SCP from the alternatives: a detective control like an AWS Config rule can flag that CloudTrail was disabled after the fact, but does not stop it from happening, and an IAM permissions boundary attaches to specific IAM entities, can be overridden by certain policy evaluations, and never restricts the root user the way an account-level SCP does. Whenever a question asks how to prevent, rather than merely detect, an action across every principal in an account, look for the option that names every relevant action denied and governs the entire account rather than one bypassable by a privileged or root-level identity.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Create an SCP in AWS Organizations that denies cloudtrail:StopLogging, cloudtrail:DeleteTrail, cloudtrail:UpdateTrail, and similar actions.
An SCP applied to the production account can deny specific CloudTrail actions across all principals in the account, including the root user. Option A is insufficient because denying only cloudtrail:DeleteTrail still allows other modifications like cloudtrail:StopLogging or cloudtrail:UpdateTrail. Option B is detective, not preventive, and does not stop users from making changes. Option D, IAM permissions boundaries, are attached to IAM entities but do not apply to all users (e.g., the root user) and can be overridden by an explicit allow; SCPs provide stronger account-wide enforcement.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Use IAM policies to deny only cloudtrail:DeleteTrail for all users.
Why it's wrong here
Denying only cloudtrail:DeleteTrail is insufficient because it still allows other modifications like StopLogging or UpdateTrail.
- ✗
Enable CloudTrail log file validation and use AWS Config to detect changes.
Why it's wrong here
CloudTrail log file validation and AWS Config are detective controls, not preventive, and do not stop users from making changes.
- ✓
Create an SCP in AWS Organizations that denies cloudtrail:StopLogging, cloudtrail:DeleteTrail, cloudtrail:UpdateTrail, and similar actions.
Why this is correct
An SCP applied to the production account can deny specific CloudTrail actions across all principals, including the root user, providing effective prevention.
- ✗
Attach an IAM permissions boundary to all IAM roles in the production account that denies CloudTrail modifications.
Why it's wrong here
IAM permissions boundaries are attached to IAM entities and do not apply to all users (e.g., the root user) and can be overridden by an explicit allow; SCPs provide stronger account-wide enforcement.
Go deeper
Related to this question
About these practice questions
One of 376 original SCS-C02 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
Same concept, more angles
2 more ways this is tested on SCS-C02
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. A company uses AWS Organizations with many accounts. The security team wants to ensure that no account can disable AWS CloudTrail or stop logging. Which configuration should be used?
hard- A.Enable CloudTrail log file validation.
- B.Attach an IAM policy to the root user in each account.
- C.Use AWS Config rules to detect and alert when CloudTrail is modified.
- ✓ D.Apply an SCP that denies cloudtrail:StopLogging and cloudtrail:DeleteTrail.
Why D: An SCP (Service Control Policy) applied at the organizational level can deny the cloudtrail:StopLogging and cloudtrail:DeleteTrail actions, preventing any account from disabling CloudTrail or stopping logging. Option A is incorrect because CloudTrail log file validation ensures integrity of log files but does not prevent stopping logging. Option B is incorrect because IAM policies attached to the root user can be overridden by the root user itself and do not prevent actions at the account level. Option C is incorrect because AWS Config rules can detect and alert when CloudTrail is modified, but they cannot prevent the modification.
Variation 2. A company uses AWS Organizations with multiple accounts. The security team wants to ensure that all member accounts have AWS CloudTrail enabled and that the logs are delivered to a centralized S3 bucket in the management account. The team creates an SCP that denies cloudtrail:StopLogging and cloudtrail:DeleteTrail. Additionally, they enable CloudTrail organizational trail. However, after some time, they discover that one member account has disabled CloudTrail. What is the most likely reason this happened?
medium- A.The member account's root user performed the action, which bypasses the SCP.
- B.The SCP was not attached to the organizational unit (OU) containing the member account.
- ✓ C.The SCP was applied to the management account instead of the member accounts.
- D.The member account's IAM user used the AWS Management Console to disable CloudTrail.
Why C: The security team created an SCP that denies cloudtrail:StopLogging and cloudtrail:DeleteTrail. If this SCP is attached to the management account only, it does not apply to member accounts. Therefore, member accounts are not restricted and can disable their own CloudTrail trails. The most likely reason for the member account disabling CloudTrail is that the SCP was applied to the management account instead of the member accounts.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SCS-C02 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SCS-C02 exam.