Use an AWS Config managed rule with the AWS-EnableCloudTrail remediation to auto re-enable logging

SCS-C02 By islever Editorial Last updated

Evaluate the compliance of AWS resources. Troubleshoot logging solutions.

Short answer

A An AWS Config managed rule with the AWS-EnableCloudTrail remediation automatically re-enables CloudTrail across Regions.

Question

A security engineer needs to build a solution to turn AWS CloudTrail back on in multiple AWS Regions in case it is ever turned off. What is the MOST efficient way to implement this solution?
  1. Use AWS Config with a managed rule to initiate the AWS-EnableCloudTrail remediation. Correct Answer
  2. Create an Amazon EventBridge event with a cloudtrail.amazonaws.com event source and a StartLogging event name to invoke an AWS Lambda function to call the StartLogging
  3. Create an Amazon CloudWatch alarm with a cloudtrail.amazonaws.com event source and a StopLoggmg event name to invoke an AWS Lambda function to call the StartLogging API.
  4. Monitor AWS Trusted Advisor to ensure CloudTrail logging is enabled.

Key Takeaways

AWS Config's managed rule plus the AWS-EnableCloudTrail remediation runs StartLogging automatically whenever a trail is detected off, across Regions, with no custom code. EventBridge (B) and CloudWatch alarms (C) can invoke Lambda but require you to build and maintain that Lambda; Trusted Advisor (D) only advises, it does not remediate. A is most efficient.

To automatically turn CloudTrail back on across multiple Regions if it is disabled, use AWS Config with a managed rule that detects trails being off and a remediation (AWS-EnableCloudTrail) that calls StartLogging. Config is regional and centrally aggregatable, so it is the most efficient, managed, no-code way to enforce logging org-wide.

Common mistake: Building EventBridge/CloudWatch alarm + Lambda (B/C)—works but is custom code you must write and maintain, less efficient than the built-in Config remediation. Relying on Trusted Advisor (D)—it reports but does not automatically re-enable CloudTrail.

Expert Analysis

Why the Answer Is Correct

AWS Config can evaluate whether CloudTrail is enabled in each Region and, via the managed remediation AWS-EnableCloudTrail, automatically call StartLogging to turn it back on. Because Config is regional and supports delegation/aggregation, this enforces logging across many Regions with no custom code—the most efficient approach.

Why the Other Options Are Wrong

B and C require you to build and maintain a Lambda function triggered by EventBridge or a CloudWatch alarm, which is more effort than the native Config remediation. D (Trusted Advisor) only surfaces the issue; it does not remediate. A is the built-in, lowest-effort solution.

Community Comment Notes

Community voted A (100). Commenters linked the AWS Prescriptive Guidance pattern for auto re-enabling CloudTrail via a Config (custom) remediation rule and called A the 'most efficient' solution. A confirmed.

Official Reference

https://docs.aws.amazon.com/config/latest/developerguide/aws-enable-cloudtrail.html

This link opens the official vendor documentation in a new tab.

Community Votes

A
100%

100% of anonymous learners picked answer A. Votes are pick records left by other test-takers — they are not the verified answer.

Discussion 5 contributions

Compiled from public community threads and reader submissions, lightly edited for clarity. Handles and vote tallies are shown as recorded, and comments reflect the views of individual contributors.

From public community threads 5

  1. Certified101 👍 6 Answered A
    https://docs.aws.amazon.com/prescriptive-guidance/latest/patterns/automatically-re-enable-aws-cloudtrail-by-using-a-custom-remediation-rule-in-aws-config.html
  2. Certified101 👍 2 Answered A
    The correct answer is A. The most efficient way to implement this solution is to use AWS Config with a managed rule to initiate the AWS-EnableCloudTrail remediation. This will automatically turn AWS CloudTrail back on if it is ever turned off.
  3. PegasusForever 👍 1 Answered C
    AWS-EnableCloudTrail -> Create an AWS CloudTrail trail and configure logging to an S3 bucket not re-enabled for that we require an AWS Config Custom Rule, not listed. MOST Efficient C. Create an Amazon CloudWatch alarm with a cloudtrail.amazonaws.com event source and a StopLoggmg event name to invoke an AWS Lambda function to call the StartLogging API. B is wrong.
  4. xTrayusx 👍 1 Answered A
    To efficiently turn AWS CloudTrail back on in multiple AWS Regions if it is ever turned off, the best approach is to use AWS Config with a managed rule to automatically remediate the situation.
  5. navid1365 👍 1 Answered A
    The "most efficient" solution is A.

Reader comments & corrections

No reader corrections yet — spotted an error or have a note? Share it below.

Log in to comment, report an error, or add a note about this question.

Submitted for moderation before publishing. Keep it helpful and respectful.

Preserve EC2 forensic evidence by isolating first, then capturing memory before stopping the instance

S-grade

Grant the report Lambda Security Hub read-only access because findings are already in Security Hub

S-grade

Deny inbound MySQL 3306 and allow outbound TLS 443 with ephemeral return in a custom NACL

S-grade

Prepare a PHI/public-bucket audit with Macie, Audit Manager, and Security Hub FSBP

S-grade

← Back to SCS-C02 Study Guide