Organization Trails Across Accounts

Large organizations run dozens or hundreds of AWS accounts. Configuring CloudTrail separately in each is tedious and error-prone, and a single missed account becomes a blind spot.

An organization trail solves this by logging activity across every account in your AWS Organization from one place.

An organization trail is created in the management or a delegated administrator account of AWS Organizations and automatically applies to all member accounts.

Every account's events flow to one central trail and S3 bucket, giving complete, uniform coverage without per-account setup.

The core benefit is a single source of truth. All API activity across the organization lands in one bucket, often in a dedicated log archive account.

Investigators query one location to see activity anywhere, and there is no risk of an account silently lacking a trail.

Best practice places the central trail's S3 bucket in a separate, locked-down log archive account that few people can access.

Isolating logs here means an attacker who compromises a workload account still cannot reach or delete the audit trail — a cornerstone of tamper-resistant logging.

A key security property: member accounts cannot turn off or modify the organization trail applied to them.

Only the management or delegated admin account controls it, so a compromised or rogue member account cannot stop its own activity from being logged. This guarantees consistent coverage.

You can delegate trail management to a dedicated security account rather than using the management account directly.

This follows least privilege for the powerful management account and lets your security team own logging without holding the organization's most sensitive root-level access.

The central S3 bucket needs a policy permitting CloudTrail from every member account to write to it.

AWS configures this automatically for organization trails, scoping writes by account and adding the conditions that keep the bucket secure while still receiving logs from across the organization.

An organization trail pairs naturally with organization-wide GuardDuty, Security Hub, and Config, all administered from the same delegated security account.

Together they form a centralized security operations model: detection, audit, and configuration tracking unified across every account in one consistent view.

Encrypt the central trail bucket with a KMS key whose policy is tightly controlled in the log archive account.

This protects the audit data at rest and adds another barrier: even with bucket access, an attacker cannot read the logs without the key. Combine encryption with Object Lock for confidentiality and immutability together.

A powerful property of organization trails is that new member accounts are logged automatically the moment they join the organization.

There is no risk of forgetting to configure CloudTrail on a freshly created account. Coverage scales with the organization, eliminating the blind spots that plague per-account trail management.

One organization trail is more cost-effective and reliable than many individual trails. The first copy of management events is generally free even across accounts.

You gain full coverage with a single configuration — fewer moving parts, no gaps, and lower operational overhead than managing trails account by account.

Why org trails resist tampering.

An organization trail is created in the management or delegated admin account of AWS Organizations and automatically logs every member account to one central bucket — ideally in a locked-down log archive account. Member accounts cannot disable it, guaranteeing tamper-resistant, gap-free coverage. Delegate administration to a security account for least privilege, pair it with org-wide GuardDuty and Config, and gain full coverage more cheaply than many separate trails.