Problem Statement
How would you structure cloud audit logging to speed investigations across many AWS accounts?
Explanation
Create a multi-Region CloudTrail per account or an organization trail that feeds a central log bucket with strict access. Enable log file integrity validation. Forward to your SIEM with clear account and Region tags. Keep retention long enough for compliance and threat dwell time. This gives responders a single, trustworthy place to search and correlate events across environments.
Code Solution
SolutionRead Only
OrgTrail → S3 audit bucket (write-only for accounts) → SIEM ingestion with account_id and region fields
