Security wants one audit trail capturing API activity across all 80 accounts in the AWS Organization, delivered to a dedicated log-archive account. What is the cleanest setup?
A.Enable a trail in each account and replicate logs with S3 replication
Per-account trails work but mean 80 configs to manage and don't auto-cover new accounts.
B.Create an organization trail in the management account logging to the log-archive account's bucket
Correct. Organization trail = one configuration, all accounts, central bucket.
C.Send each account's CloudTrail to a shared SNS topic
SNS fans out notifications, not durable log delivery — and still needs per-account trails.
D.Enable CloudTrail Lake in every account
CloudTrail Lake queries events but the org-wide aggregation primitive is still an organization trail; Lake in each account fragments data.
Why this answer
An organization trail (created in the management or a delegated admin account) logs every member account to a single bucket — centrally managed, automatically covering new accounts, and the standard multi-account audit pattern.
Correct answer: B · Last reviewed 2026-10-26
Official AWS references
Practice this interactively
Answer without seeing the solution first in the Logging & Audit practice session.
Practice Logging & Audit