Prevent Disabling CloudTrail with SCP — AWS Organizations Security
A company uses AWS Organizations with multiple accounts. The security team wants to prevent all users in the production account from disabling AWS CloudTrail or modifying its configuration. What is the MOST effective way to achieve this?
Quick Answer
The reason a broad SCP denying multiple specific actions is the most effective approach is that CloudTrail can be tampered with in more than one way, and a control that blocks only one of those ways leaves the others open. Someone could stop logging with StopLogging, delete the trail with DeleteTrail, or weaken its configuration with UpdateTrail, so a preventive control needs to deny all of those actions, not just deletion, to guarantee CloudTrail keeps running as configured. An SCP is also structurally the right mechanism because it applies at the account level to every principal, including the root user, which is critical since CloudTrail tampering is exactly the kind of action a compromised or malicious privileged principal might attempt. This is what separates an SCP from the alternatives: a detective control like an AWS Config rule can flag that CloudTrail was disabled after the fact, but does not stop it from happening, and an IAM permissions boundary attaches to specific IAM entities, can be overridden by certain policy evaluations, and never restricts the root user the way an account-level SCP does. Whenever a question asks how to prevent, rather than merely detect, an action across every principal in an account, look for the option that names every relevant action denied and governs the entire account rather than one bypassable by a privileged or root-level identity.
⚠ Common exam trap
SCS-C02 often tests the difference between preventive and detective controls, and candidates frequently choose IAM policies or AWS Config when the requirement is to prevent actions across an entire account or organization.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Create an SCP in AWS Organizations that denies cloudtrail:StopLogging, cloudtrail:DeleteTrail, cloudtrail:UpdateTrail, and similar actions.
Service Control Policies (SCPs) in AWS Organizations provide centralized, preventive control over the maximum permissions for all accounts in an organization or OU. By creating an SCP that denies CloudTrail actions such as StopLogging, DeleteTrail, and UpdateTrail, the security team can ensure that no user or role in the production account can disable or modify CloudTrail, even if they have IAM permissions. This is the most effective and scalable way to enforce this restriction across the account.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Use IAM policies to deny only cloudtrail:DeleteTrail for all users.
Why it's wrong here
Denying only cloudtrail:DeleteTrail leaves StopLogging, UpdateTrail and DeleteTrail's siblings permitted, so users can still disable or reconfigure trails. The scenario needs an Organizations SCP that denies the full cloudtrail:* action set across the account. A narrow IAM deny is tempting for least-privilege tuning, but SCPs are the control that constrains every principal in a member account.
- ✗
Enable CloudTrail log file validation and use AWS Config to detect changes.
Why it's wrong here
Log file validation proves integrity after the fact and AWS Config records configuration changes; neither blocks the API call, so a user can still stop or alter CloudTrail. The requirement is prevention, which an Organizations SCP denying CloudTrail actions delivers. Detection tooling is the right choice for audit and compliance evidence, not for stopping the action itself.
- ✓
Create an SCP in AWS Organizations that denies cloudtrail:StopLogging, cloudtrail:DeleteTrail, cloudtrail:UpdateTrail, and similar actions.
Why this is correct
SCPs in AWS Organizations set the maximum available permissions for every principal in a member account, including the root user, so a deny for cloudtrail:StopLogging, DeleteTrail and UpdateTrail blocks all users in the production account regardless of their IAM policies.
- ✗
Attach an IAM permissions boundary to all IAM roles in the production account that denies CloudTrail modifications.
Why it's wrong here
Permissions boundaries cap identity-based permissions but do not apply to resource-based policies, and they must be attached to every role and user individually, so a new principal without the boundary escapes the restriction. The stem requires an Organizations SCP denying CloudTrail actions account-wide. Boundaries suit delegating maximum permissions to developers creating roles, not organisation-wide guardrails.
Go deeper
Related to this question
About these practice questions
One of 1,205 original SCS-C02 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
Same concept, more angles
2 more ways this is tested on SCS-C02
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. A company uses AWS Organizations with many accounts. The security team wants to ensure that no account can disable AWS CloudTrail or stop logging. Which configuration should be used?
hard- A.Enable CloudTrail log file validation.
- B.Attach an IAM policy to the root user in each account.
- C.Use AWS Config rules to detect and alert when CloudTrail is modified.
- ✓ D.Apply an SCP that denies cloudtrail:StopLogging and cloudtrail:DeleteTrail.
Why D: Service Control Policies (SCPs) in AWS Organizations are the only mechanism that can enforce a hard deny across all accounts in an organization, preventing even account root users from performing specified actions. By applying an SCP that denies cloudtrail:StopLogging and cloudtrail:DeleteTrail, the security team ensures no account can disable or delete CloudTrail trails, regardless of IAM permissions within the account. SCPs define the maximum available permissions for accounts in the organization.
Variation 2. A company uses AWS Organizations with multiple accounts. The security team wants to ensure that all member accounts have AWS CloudTrail enabled and that the logs are delivered to a centralized S3 bucket in the management account. The team creates an SCP that denies cloudtrail:StopLogging and cloudtrail:DeleteTrail. Additionally, they enable CloudTrail organizational trail. However, after some time, they discover that one member account has disabled CloudTrail. What is the most likely reason this happened?
medium- A.The member account's root user performed the action, which bypasses the SCP.
- B.The SCP was not attached to the organizational unit (OU) containing the member account.
- ✓ C.The SCP was applied to the management account instead of the member accounts.
- D.The member account's IAM user used the AWS Management Console to disable CloudTrail.
Why C: The security team created an SCP that denies cloudtrail:StopLogging and cloudtrail:DeleteTrail. If this SCP is attached to the management account only, it does not apply to member accounts. Therefore, member accounts are not restricted and can disable their own CloudTrail trails. The most likely reason for the member account disabling CloudTrail is that the SCP was applied to the management account instead of the member accounts.
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official Amazon Web Services exam blueprint
This SCS-C02 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SCS-C02 exam.