A company uses AWS Organizations. The security team wants to ensure that no IAM user or role can disable AWS CloudTrail in any member account, even if they have AdministratorAccess. How can this be achieved?

Create an IAM permissions boundary and attach it to all users and roles.

Apply a Service Control Policy (SCP) to the organization root that denies the cloudtrail:StopLogging action.

Use AWS Config rules to automatically restart CloudTrail if it is stopped.

Enable CloudTrail Organization trails, which cannot be disabled by member accounts.