SAP-C02 · Review mode

A multinational enterprise runs 200+ AWS accounts in a single Organization. Security wants to ensure that no member account can disable AWS CloudTrail or AWS Config. What is the most effective and lowest-maintenance enforcement?

• AA. Apply an SCP at the org root denying cloudtrail:StopLogging, cloudtrail:DeleteTrail, config:StopConfigurationRecorder, and config:DeleteConfigurationRecorder
• BB. Email all account owners and ask them not to disable these services
• CC. Run a Lambda hourly to re-enable any disabled trails
• DD. Move all accounts to a single account