Security, Compliance, and Governance · Topic 5 of 8
Centralized Logging and Audit Trails
Centralize CloudTrail organization trails, Config aggregation, GuardDuty and Security Lake, log AI invocations, and keep tamper-proof audit trails.
- 6 min
- Organization trails log every account and member accounts cannot change them.
- Data events are off by default; turn them on only where needed.
- A Config aggregator is a read-only central view; rules still run per account.
What it is
Central logging answers two questions for a whole organization: what happened, and what does every resource look like right now. API activity comes from AWS CloudTrail, configuration history from AWS Config, and threat signals from Amazon GuardDuty.
Audit trail management adds a regulator's demands on top. Logs must be complete, kept for the required period, protected from tampering, and readable only by the right people. AI workloads add one more record: the prompts and responses themselves.
How it works
CloudTrail organization trails
An organization trail is created in the management account or a delegated administrator account and logs every account in the organization. Member accounts can see the trail but cannot change or delete it, which is why it beats per-account trails.
Management events are logged by default. Data events, such as S3 object reads or Lambda invocations, must be turned on explicitly and cost extra, so enable them where the audit requirement names object-level access.
For SQL queries across accounts, AWS CloudTrail Lake stores events in event data stores. The cheaper alternative is to keep the S3 delivery and query with Amazon Athena.
AWS Config aggregation
AWS Config records resource configuration changes and evaluates rules. An aggregator collects that data from many accounts and Regions into one account. An organization aggregator picks up new accounts automatically.
The aggregator gives a read-only, central view of resources and compliance. Rules still run in each account; use organization Config rules or conformance packs to deploy them everywhere.
Threat detection and findings
Amazon GuardDuty analyzes CloudTrail events, VPC Flow Logs and DNS logs, with optional protection plans for S3, EKS, runtime monitoring, malware scanning, RDS and Lambda. Set a delegated administrator and auto-enable it for new member accounts.
AWS Security Hub CSPM collects findings from GuardDuty, Amazon Inspector, Amazon Macie and partner products in the AWS Security Finding Format (ASFF). Cross-Region aggregation brings them into one home Region. The newer AWS Security Hub builds on this and correlates signals into exposure findings for prioritization.
Amazon Security Lake
Security Lake builds a security data lake in Amazon S3 in a delegated administrator account. It normalizes logs into the Open Cybersecurity Schema Framework (OCSF).
Native sources include CloudTrail events, VPC Flow Logs, Route 53 Resolver query logs, Security Hub findings, EKS audit logs and AWS WAF logs, plus third-party sources. Rollup Regions consolidate data from contributing Regions, and subscribers get either data access or query access.
| Need | Choose |
|---|---|
| Who called which API, across every account | CloudTrail organization trail |
| Configuration history and compliance in one view | AWS Config organization aggregator |
| Threat detection with minimal setup | GuardDuty with a delegated administrator |
| One normalized store for SIEM and long-term analysis | Amazon Security Lake (OCSF) |
| Application and OS logs from many accounts | CloudWatch Logs with cross-account subscriptions or cross-account observability |
Logging AI model invocations
CloudTrail records Amazon Bedrock API calls: who called which model, when and from where. It does not record the prompt and the response.
For content, enable Bedrock model invocation logging. It is disabled by default and is configured per Region. It captures request data, response data and metadata for Converse, ConverseStream, InvokeModel and InvokeModelWithResponseStream.
Destinations are CloudWatch Logs, Amazon S3 or both, in the same account and Region. Bodies up to 100 KB go inline; larger bodies and binary output go to S3 only.
For Amazon SageMaker AI real-time endpoints, data capture saves request and response payloads to S3, and CloudTrail records the SageMaker API calls.
Audit trail management for regulated workloads
Regulators care about four properties.
| Property | Control |
|---|---|
| Complete | Organization trail in all Regions, data events where required, invocation logging for AI |
| Tamper evident | CloudTrail log file integrity validation (digest files) |
| Immutable | S3 Object Lock in compliance mode on the log bucket, in a separate Log Archive account |
| Restricted | SCP that denies stopping or deleting trails; KMS key policy limiting who can decrypt logs |
Retention comes from S3 Lifecycle rules (for example, move to S3 Glacier storage classes after 90 days) and the Object Lock retention period. Prompts and responses can contain personal data, so encrypt AI logs with a customer managed KMS key and restrict reads to the audit team.
How the exam asks about this
- "Auditors need every API call in 200 accounts, and account administrators must not be able to disable logging." -> CloudTrail organization trail to a Log Archive account, plus an SCP denying
StopLoggingandDeleteTrail. - "Compliance needs a record of every prompt and model response for a Bedrock chatbot." -> Enable Bedrock model invocation logging to S3 or CloudWatch Logs.
- "Logs must be provably unaltered and undeletable for seven years." -> Integrity validation plus S3 Object Lock in compliance mode with a seven-year retention.
What to remember for the exam
- Organization trails log every account and member accounts cannot change them.
- Data events are off by default; turn them on only where needed.
- A Config aggregator is a read-only central view; rules still run per account.
- Security Lake normalizes security logs into OCSF in S3.
- CloudTrail shows who invoked a model; invocation logging shows what was asked and answered.
- Object Lock compliance mode plus integrity validation make logs immutable and tamper evident.
Model invocation logging is off by default and Regional. If a question says prompts must be retained, an answer that only mentions CloudTrail is incomplete.
Common mistakes
Keeping logs in the account that produced them. A compromised account can delete local logs. Send them to a separate Log Archive account that workload administrators cannot touch.
Using Object Lock governance mode for regulatory retention. Users with special permission can bypass governance mode. Compliance mode cannot be shortened or removed by anyone, including the root user.
Treating a Config aggregator as enforcement. The aggregator only shows data. Preventing or fixing noncompliance needs rules, remediation or preventive policies.
Check yourself
Why use an organization trail instead of a trail in each account?
It covers every account automatically and member accounts cannot modify or delete it.
Where do Bedrock prompts and responses get recorded?
In model invocation logging, delivered to CloudWatch Logs or S3 in the same account and Region, not in CloudTrail.
Which S3 feature makes audit logs undeletable for a fixed period?
S3 Object Lock in compliance mode with a retention period.
Topic 5 of 8 in Security, Compliance, and Governance
Test yourself on Security, Compliance, and Governance
The full AWS SAP-C03 question bank has 850 questions, with timed practice exams and an explanation for every answer.
This study guide is independent and is not affiliated with, endorsed by, or sponsored by AWS. Vendor names, certification names and exam codes are trademarks of their respective owners and are used for identification only.