Centralized AWS Security Logging Architecture
AWS Organizations centralizes CloudTrail and Config evidence in an S3 audit lake that security teams query with Athena and QuickSight.
Open editable diagramArchitecture diagram
Edit this exact diagram
Open on the canvasCentralized AWS security logging diagram with Organizations, CloudTrail, Config, S3, Athena, and QuickSight. The image links to a fully editable BuildPlane starter.
Overview
AWS Organizations defines the account scope for an organization trail and AWS Config coverage. CloudTrail activity and Config evidence are delivered to a protected central S3 archive, where Athena supports investigations and QuickSight publishes recurring security views.
Components
- AWS Organizations: The organization defines the account scope for centralized audit collection.
- CloudTrail, Config, and S3: Activity and configuration history are retained in a protected central evidence store.
- Athena and QuickSight: Security teams query retained evidence and communicate recurring controls through dashboards.
Audit Evidence Flow
- Organization-level CloudTrail and Config coverage collects activity and resource state.
- Both evidence streams write into a centrally controlled S3 archive.
- Athena investigations feed repeatable security and compliance dashboards.
Customize First
- Separate log archive, security tooling, and workload administration accounts.
- Add GuardDuty and Security Hub workflows for active detection and response.
- Test that workload administrators cannot alter organization trails or retained evidence.
Design rationale
Decisions that shape this architecture
Collect at organization scope
Organization-level coverage reduces account-by-account drift and makes new account logging part of the default governance model.
Protect evidence outside workload administration
A dedicated archive account limits the ability of workload administrators to alter trails, delete evidence, or weaken retention.
Separate storage from investigation
S3 remains the durable evidence store while Athena and QuickSight provide replaceable query and reporting views over retained records.
Before production
Operational checks
Detect disabled trails, stopped Config recorders, delivery failures, and policy changes.
Test archive write permissions, read separation, Object Lock, encryption, and retention.
Partition and compact audit data so common Athena investigations remain practical.
Run incident queries and evidence-retrieval exercises before an audit or breach.
Scope and tradeoffs
What this diagram does not solve
Logging is not active threat response
Add detection, triage, alerting, and response workflows such as GuardDuty and Security Hub around the retained evidence.
One Region is shown for analysis
Organizations with multi-Region requirements should design collection, residency, replication, and investigation access for each required location.
Common questions
Frequently asked questions
Why combine CloudTrail and AWS Config evidence?
CloudTrail records API activity, while Config records resource state and change history. Together they help investigators connect an action to its infrastructure effect.
Should the log archive use a separate AWS account?
Usually yes. A dedicated security or log-archive account creates a stronger administrative boundary from workload teams and compromised application accounts.
Is QuickSight required for security logging?
No. It is one reporting option. Retain S3 and Athena as the evidence and query foundation, then choose dashboards that match the security workflow.
Keep exploring
Related AWS architectures
Secure File Upload and Malware-Scanning Pipeline on AWS
This architecture keeps large upload bytes out of the API, lands every object in an encrypted trust boundary, scans before promotion, quarantines suspicious files, and exposes processing status to the application. It is a security-focused workflow rather than a generic upload shortcut.
Explore the architecture
Serverless Multi-Tenant SaaS Architecture on AWS
This architecture combines a protected synchronous API with a durable asynchronous work path. Tenant identity travels from Cognito into application authorization, domain events decouple background work, and DynamoDB plus S3 provide scalable tenant state and assets.
Explore the architecture
Secure Application Authentication with Amazon Cognito
This architecture separates identity verification from application authorization. Cognito authenticates the user, API Gateway validates the presented token, Lambda enforces business rules, and DynamoDB remains behind the application boundary.
Explore the architectureFrom reference to working draft
Adapt this architecture with your AWS AI Agent
Start from the exact diagram in this guide. Change requirements, challenge a decision, or ask what fails first, while keeping the architecture editable.