A company enabled a CloudTrail organization trail. Where are management events from member accounts delivered?
Show answer and explanation
Answer: B
A trail created as an organization trail in the management or delegated administrator account writes events for every member account to the destinations configured on that trail. Typically that means a central S3 bucket, with optional forwarding into CloudWatch Logs or a CloudTrail Lake event data store. Individual member accounts therefore do not have to create trails of their own for those events to be captured.
Why the other options are wrong
- A. Member accounts do not maintain separate buckets for an organization trail; delivery goes to the trail's configured location.
- C. Event history in the management account shows only that account's events and retains them briefly.
- D. GuardDuty does not receive trail events automatically as a log destination.