Centralized and Immutable CloudTrail Logging
Specification & Description
Aggregate multi-region AWS CloudTrail audit logs from all AWS Organizations member accounts into a dedicated, centralized Log Archive account secured with KMS CMK encryption, log file validation, and S3 Object Lock compliance retention.
Technical Specifications
A foundational security baseline requirement for any AWS Landing Zone is continuous, centralized, and tamper-proof event logging. AWS CloudTrail records all management and data API calls made across an organization.
1. Multi-Account Organization Trail Architecture
- Configured from the AWS Organizations Management account (or delegated administrator).
- An Organization Trail automatically logs API events for all existing and newly provisioned member accounts across all AWS regions.
- Member accounts cannot view, modify, or delete the organizational trail locally.
2. Dedicated Centralized S3 Log Archive Storage
- CloudTrail log files are delivered directly to an S3 bucket residing in the dedicated, isolated Log Archive account.
- S3 Object Lock is enabled in Compliance Mode with a mandatory retention period (e.g., 365 days or 7 years). In Compliance Mode, no user (including root or AWS account administrators) can overwrite or delete log objects before the retention period expires.
- S3 Bucket Policies enforce strict
aws:SourceArnvalidation and enforce TLS 1.2+ encrypted in-transit connections (aws:SecureTransport: true).
3. Customer Managed KMS Key (CMK) Encryption
- Log files are encrypted at rest using an AWS KMS Customer Managed Key with key rotation enabled.
- The KMS key policy permits the
cloudtrail.amazonaws.comservice principal across the organization while preventing unauthorized decryption attempts from unprivileged roles.
4. Cryptographic Log File Validation
- CloudTrail log file validation produces signed SHA-256 digest files every hour.
- Enables security and forensic teams to mathematically verify whether any log file was modified, deleted, or forged following delivery.
5. Preventative SCP Guardrail
- A Service Control Policy (SCP) attached to the Organization Root denies
cloudtrail:StopLogging,cloudtrail:DeleteTrail,cloudtrail:UpdateTrail, and bucket deletion actions across all member accounts.
Security Rationale
Centralized, immutable audit logs provide the indispensable foundation for security incident response, forensic timeline reconstruction, threat hunting, and compliance validation. Without centralized immutability in an isolated Log Archive account, an attacker compromising an individual member account could disable logging or delete forensic trails to conceal unauthorized lateral movement or data exfiltration.
Operational & Implementation Notes
When provisioning the centralized S3 Log Archive bucket, ensure that S3 server access logging is NOT enabled on the CloudTrail target bucket itself. Directing S3 access logs back into the same bucket creates an infinite recursive logging loop resulting in rapid storage growth and severe cost escalation. Refer to AWS-DATA-004 for loop prevention guardrails.