🧾 JSONmedium
2. Protect the audit trail (SCP)
Write an SCP statement that stops anyone from tampering with CloudTrail auditing. One Deny statement covering BOTH actions: • Effect: "Deny" • Action: ["cloudtrail:StopLogging", "cloudtrail:DeleteTrail"] • Resource: "*"
How to approach this
An immutable audit trail is required for RMF/FedRAMP continuous monitoring and incident reconstruction. An attacker (or a careless admin) who can stop or delete CloudTrail blinds your logging. An SCP that Denies `cloudtrail:StopLogging` and `cloudtrail:DeleteTrail` org-wide protects the audit trail from everyone — even account admins — because SCPs cap maximum permissions. No condition needed; the Deny is unconditional.
config.json