Centralize CloudTrail Logs Across AWS Organizations
A company uses AWS Organizations with multiple accounts. They want to centralize logging of all API calls across all accounts and store them in a single S3 bucket. Which configuration should be used?
⚠ Common exam trap
Candidates often confuse AWS Config (which records configuration changes) with CloudTrail (which records API calls), or they think VPC Flow Logs can substitute for API logging, leading them to select options that do not meet the requirement for centralized API call logging.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Create an organization trail in the management account
AWS Organizations allows you to create an organization trail in the management account that automatically logs API calls for all member accounts. This centralizes CloudTrail logs into a single S3 bucket without needing to configure individual trails per account, ensuring complete coverage and simplified management.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Use AWS Config to record API calls across all accounts
Why it's wrong here
AWS Config records resource configuration changes and compliance state, not API call activity, so it cannot capture the API calls the stem requires. Config suits tracking resource configuration drift and compliance, whereas CloudTrail is the service that logs API activity.
- ✗
Create a separate CloudTrail trail in each account and aggregate logs using Amazon Athena
Why it's wrong here
Separate trails per account with Athena aggregation requires custom querying and does not deliver logs to a single S3 bucket natively; Athena is a query service, not a log aggregation pipeline. This suits ad hoc analysis of existing logs, not centralised multi-account trail delivery.
- ✓
Create an organization trail in the management account
Why this is correct
An organization trail created in the management account automatically logs API activity across every account in AWS Organizations into one S3 bucket, satisfying the centralisation requirement. Account-level trails would need separate configuration per account and would not aggregate automatically.
- ✗
Enable VPC Flow Logs in each account and send to a central S3 bucket
Why it's wrong here
VPC Flow Logs capture IP traffic metadata at the ENI, subnet or VPC level, not API activity, so they cannot record CloudTrail events. They are tempting because they centralise network telemetry to S3, which is correct when diagnosing connectivity, security groups or rejected traffic rather than auditing API calls.
Quick reference
AWS S3 Storage Class Comparison
| Storage Class | Min Duration | Retrieval | Use Case |
|---|---|---|---|
| S3 Standard | None | Immediate | Frequently accessed data |
| S3 Standard-IA | 30 days | Immediate | Infrequent access, rapid retrieval |
| S3 One Zone-IA | 30 days | Immediate | Non-critical infrequent data |
| S3 Intelligent-Tiering | None | Immediate–hours | Unknown or changing access patterns |
| S3 Glacier Instant | 90 days | Milliseconds | Archive with instant retrieval |
| S3 Glacier Flexible | 90 days | Minutes–hours | Archive, flexible retrieval |
| S3 Glacier Deep Archive | 180 days | Hours | Long-term compliance archive |
Go deeper
Related to this question
About these practice questions
This SCS-C02 question is part of Courseiva's 1,205-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
Same concept, more angles
1 more way this is tested on SCS-C02
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. A company uses AWS Organizations with multiple accounts. The security team wants to ensure that all CloudTrail trails are enabled in all accounts and log to a central S3 bucket. What is the MOST efficient way to enforce this?
hard- A.Use AWS Lambda to check each account and enable CloudTrail if missing.
- B.Use AWS Config aggregator to verify compliance and send alerts.
- C.Create a service control policy (SCP) that requires CloudTrail.
- ✓ D.Use AWS CloudFormation StackSets to deploy a CloudTrail template to all accounts.
Why D: AWS CloudFormation StackSets allows you to deploy a CloudTrail template across multiple accounts and Regions from a single management account, ensuring all accounts have a trail configured to log to the central S3 bucket. This approach is the most efficient as it automates deployment, enforces consistent configuration, and scales across the entire organization without requiring per-account manual intervention or custom scripting.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SCS-C02 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SCS-C02 exam.