Keep one audit trail for the whole organization that no account can change

How to do it

After a breach, the cloud audit trail is the only record of what the attacker did with stolen keys. Attackers know this and turn it off first. Create the trail once for the whole organization, such as an AWS CloudTrail organization trail, so new accounts are covered from their first minute. On Google Cloud, Admin Activity audit logs are always on, so route them to a central bucket with a log sink. Turn on Data Access logs for buckets that hold personal data. On Azure, send the activity log of every subscription to one workspace. Turn on log file validation, so a changed file shows. Keep the store in a log archive account that production staff cannot change. Lock it as in Keep one backup copy that no account can delete. Set the period from Keep audit logs for a set time. Forbid stopping the trail with an organization policy, as Block dangerous actions for the whole organization says.

Examples

Terraform example

resource "aws_cloudtrail" "organization" {
  name                       = "organization-audit"
  s3_bucket_name             = "example-shop-log-archive"
  is_organization_trail      = true
  is_multi_region_trail      = true
  enable_log_file_validation = true
}

Shell example

# Expect true and true
aws cloudtrail describe-trails --query 'trailList[?Name==`organization-audit`].[IsOrganizationTrail, IsMultiRegionTrail]' --output text
aws cloudtrail get-trail-status --name organization-audit --query IsLogging

How to check

A script confirms that the organization trail logs every region and every account, including accounts created in the last 30 days. The log account's storage reports a write-once lock with the stated period. In a sandbox, an attempt to stop the trail is refused, and the attempt itself raises an alert within 15 minutes.

Sources

• AWS CloudTrail, Creating a trail for an organization
• Google Cloud Audit Logs overview
• NIST SP 800-53 Rev. 5, AU-9 Protection of Audit Information

Related rules

• OPS-80 Keep one backup copy that no account can delete in Operations and observability
• CMP-28 Keep audit logs for a set time in Compliance and governance
• INF-40 Block dangerous actions for the whole organization in Infrastructure and environments