A regulated enterprise with 200 accounts must keep security logs from CloudTrail, Config, VPC flow logs and application logs. The logs must be protected so that no one, including administrators in the workload accounts, can alter or delete them before retention ends. Which design meets this?
Show answer and explanation
Answer: A
The AWS Security Reference Architecture places centralized, immutable logs in a dedicated log archive account. Object Lock in compliance mode prevents anyone from deleting or overwriting protected object versions until retention expires, including the root user of the bucket owner. KMS encryption and SCPs that restrict changes to the logging pipeline keep the archive intact even if a workload account is compromised.
Why the other options are wrong
- B. Default buckets in each workload account are controlled by that account's administrators, who could delete objects or change lifecycle rules. The logs are not tamper-resistant.
- C. DynamoDB is not designed as a log archive for CloudTrail or flow log delivery, and table items can be deleted by anyone with write permission on the table.
- D. Administrators in each account can delete log events or shorten log group retention with sufficient permissions, so central tamper resistance is missing.