Block dangerous actions for the whole organization

How to do it

Use the cloud's organization policies, such as AWS service control policies, Google Cloud organization policies or Azure Policy. Deny turning off or deleting the audit trail, leaving the organization, and using regions outside the list. Block public storage and service account keys. Keep a short exception for the break-glass role. Apply them from code in the management account. AWS service control policies do not bind the management account itself, so run no workloads there.

Example

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Sid": "ProtectAuditTrail",
      "Effect": "Deny",
      "Action": ["cloudtrail:StopLogging", "cloudtrail:DeleteTrail", "organizations:LeaveOrganization"],
      "Resource": "*",
      "Condition": { "ArnNotLike": { "aws:PrincipalARN": "arn:aws:iam::*:role/break-glass" } }
    },
    {
      "Sid": "AllowedRegionsOnly",
      "Effect": "Deny",
      "NotAction": ["iam:*", "organizations:*", "sts:*", "support:*", "cloudfront:*", "route53:*"],
      "Resource": "*",
      "Condition": { "StringNotEquals": { "aws:RequestedRegion": ["eu-north-1", "eu-west-1"] } }
    }
  ]
}

How to check

In a sandbox account, an admin tries to stop the audit trail and to start a server in a region outside the list. Both calls end in AccessDenied.