Log Archive Account Isolation and Immutability Guardrails
Specification & Description
Enforce strict account-level isolation and preventative Service Control Policies (SCPs) on the dedicated Log Archive account to prohibit deletion of log groups, destruction of encryption keys, tampering with lifecycle rules, and unauthorized interactive administrative access.
Technical Specifications
The dedicated Log Archive account is the central vault for all security audit trails across the AWS Landing Zone. Because it stores forensic evidence, it requires the most restrictive account boundary in the entire organization.
1. Preventative SCP Guardrails on the Log Archive OU
- Attached to the dedicated Core/Security Organizational Unit containing the Log Archive account.
- Denies deletion or modification of CloudWatch log groups (
logs:DeleteLogGroup,logs:DeleteRetentionPolicy). - Denies KMS key destruction or disablement (
kms:ScheduleKeyDeletion,kms:DisableKey). - Denies modification of S3 lifecycle policies (
s3:PutLifecycleConfiguration,s3:DeleteBucketLifecycle) to prevent accelerating log expiration. - Denies tampering with organization trails or S3 Object Lock settings.
2. Zero Standing Privileges & Break-Glass Access Model
- No engineers, developers, or standard administrators should have standing interactive access or permanent IAM credentials in the Log Archive account.
- Access is restricted exclusively to automated service principals (CloudTrail, VPC Flow Logs, Config) and an audited, MFA-gated Break-Glass Emergency Role monitored by automated alerts.
Security Rationale
If an adversary compromises an organization administrator credential, account-level guardrails and SCPs prevent the attacker from destroying historical audit logs, deleting KMS keys, or shortening S3 lifecycle retention. Strict isolation guarantees that forensic evidence survives even worst-case organization-level security compromises.