Exam AWS-SysOps topic 1 question 870 discussion

Answer C When you create an organization trail, a trail with the name that you give it will be created in every AWS account that belongs to your organization. Users with CloudTrail permissions in member accounts will be able to see this trail when they log into the AWS CloudTrail console from their AWS accounts, or when they run AWS CLI commands such as describe-trail. However, users in member accounts will not have sufficient permissions to delete the organization trail, turn logging on or off, change what types of events are logged, or otherwise alter the organization trail in any way. https://docs.aws.amazon.com/awscloudtrail/latest/userguide/creating-trail-organization.html

By setting up an organization trail, you can aggregate and centralize the CloudTrail logs from all the member accounts into a single S3 bucket owned by the master account. This ensures that the security team has secure access to the logs without needing to access individual accounts separately. Additionally, using IAM roles, you can enforce strict access controls to prevent modification of the logs. The IAM roles can be associated with specific users or groups who need to view the logs but don't have the permission to modify them, providing the necessary separation of responsibilities.