Exam AWS Certified Security - Specialty SCS-C02 topic 1 question 251 discussion

AWS Organizations allows Service Control Policies (SCPs) to restrict actions across all accounts in an organization or organizational units (OUs). An SCP with an explicit Deny for the StopLogging and DeleteTrail actions will prevent CloudTrail from being stopped or deleted, ensuring continuous logging. SCPs override any IAM permissions in the member accounts, making this the best and most effective solution.

Service Control Policies (SCPs): These are powerful tools within AWS Organizations that allow you to enforce organization-wide controls over AWS resources and APIs. Explicit Deny Rule: By explicitly denying the StopLogging and DeleteTrail actions, you ensure that no account within the organization can disable CloudTrail or delete the trails, thus maintaining compliance and continuous logging. Root OU: Attaching the SCP to the root Organizational Unit ensures that the policy applies to all accounts within the organization, providing comprehensive coverage.