Skip to content

Primary SAA curriculum

Secure Cross-Account CloudTrail Logging

Centralized CloudTrail evidence across an AWS organization using an organization trail, a separate log archive account, restrictive S3 and KMS policies, validation, and retention controls.

4 min read

After this, you will understand

This lesson turns CloudTrail from a checkbox into a protected evidence pipeline whose coverage, ownership, integrity, retention, and investigation access are explicit.

Article guideprerequisites, mental models, and concepts

Article overview

intermediateCloudCertificationSecurity

Three useful mental models

In plain terms

An organization trail records account activity and delivers it to a protected S3 bucket owned by a separate log archive account.

Decision pressure

Workload administrators own their only logs, high-value data events are never selected, or a bucket or KMS policy silently blocks delivery.

Exam-ready model

Centralize collection, separate evidence ownership, permit only controlled delivery and reading, validate integrity, and monitor the logging system itself.

Think before reading

Why put audit logs in a separate account?

It reduces the chance that a compromised workload account can erase the evidence needed to investigate that compromise.

Connected learning

These lessons add useful context to the current core lesson.
  1. 1Centralized Security Findings And Incident TriageAWS Scenario

The Evidence Must Outlive The Workload Account

CloudTrail answers who called an AWS API, what action they requested, where it came from, when it happened, and the result. But logs are weak evidence if an administrator who compromises a production account can also stop its trail or delete its only archive.

The design therefore separates where activity happens from who owns the evidence. Recent CloudTrail Event history is useful for lookup, but it is not the durable, organization-wide archive.

Build A Protected Evidence Pipeline

  1. An organization trail extends consistent coverage across the Organizations management account and member accounts. Configure it as multi-Region when activity across enabled Regions must be covered; newly added organization accounts then enter the trail's scope.
  2. Event selectors decide what actually becomes a record. Management events are the control-plane baseline. High-volume data events, such as selected S3 object operations or Lambda invocations, must be chosen deliberately. Organization and Region scope cannot create an event that selectors omit.
  3. CloudTrail observes supported activity after it reaches the AWS service, batches the records, and delivers them to S3. It is not an inline API firewall and delivery is not instantaneous.
  4. The destination is an S3 bucket in a separate log archive account. Its bucket policy allows CloudTrail to write only to expected organization and account prefixes. Workload administrators do not receive authority to reconfigure or delete the archive.
  5. If customer-managed SSE-KMS is used, the KMS key policy separately authorizes key use for delivery and decrypt access for investigators. S3 permission alone is not KMS permission.
  6. Investigators receive scoped S3 read and, when needed, KMS decrypt access. Athena or a SIEM may query the archive, but those consumers do not replace the record source.
The S3 bucket policy and KMS key policy are separate authorization boundaries: delivery needs both, investigators receive scoped read and decrypt access, and workload administrators do not control the archive.
Read deeper into cross-account delivery and access policies

Integrity, Recovery, And Prevention Are Different

CloudTrail log file validation uses signed digest files to detect whether delivered logs changed or disappeared. Enabling it does not prevent deletion and validation still has to be performed.

S3 Versioning retains earlier object versions so an overwrite may be recoverable. S3 Object Lock rejects overwrite or deletion during the configured retention period. Lifecycle policies move or expire data according to retention rules; they must not undermine required evidence availability.

Validation detects tampering, Versioning supports recovery, and Object Lock prevents early overwrite or deletion; none of the three substitutes for the others.
Read deeper into validation, Versioning, and Object Lock

Monitor the evidence pipeline itself: trail deletion or stoppage, selector changes, delivery failures, bucket or key policy changes, and retention-control changes. Near-real-time alerting can use an additional CloudWatch Logs path, while S3 remains the durable archive.

SAA Recognition And Traps

  • “Consistent audit coverage across existing and future member accounts” points to an organization trail because the scope follows the organization.
  • “Preserve logs from a compromised workload administrator” points to a separate log archive account and protected S3 bucket because evidence ownership crosses the workload boundary.
  • “Allow CloudTrail delivery into another account” requires an S3 bucket policy for the expected delivery path; customer-managed encryption additionally requires the KMS key policy to allow key use.
  • “Detect whether delivered logs were modified” points to log file validation; “prevent deletion during retention” points to S3 Object Lock.
  • Do not treat Event history as the durable archive or assume data events are universally logged.
  • Do not say CloudTrail blocks an API call, detects threats by itself, or delivers every event with zero delay.
  • Do not grant broad workload-account access to the archive, and do not confuse encryption with immutability.

One-Minute Review

API activity in member accounts
-> organization + multi-Region trail establishes coverage
-> selectors decide which events exist
-> CloudTrail batches delivery across the account boundary
-> bucket policy and optional KMS key policy authorize delivery
-> validation detects tampering; Versioning recovers; Object Lock prevents early deletion
-> scoped investigators query preserved evidence

If you remember only one thing: CloudTrail records activity, but trustworthy audit evidence comes from organization coverage plus a separately controlled, protected archive.

Finished reading?

Your reading history is saved in this browser so you can continue later.

Recommended Next

Centralized Security Findings And Incident TriageAWS Architecture Scenarios9 min read

This applies the foundation mental models to a real architecture decision instead of a service inventory.

Optional exploration

These links add context, but they do not replace the recommended next lesson.

Arcflow Plus is coming — review drills, research breakdowns, more AI. Get one email at launch.

One email at launch. That's it.